./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor1704889572 <...> Warning: Permanently added '10.128.1.82' (ED25519) to the list of known hosts. execve("./syz-executor1704889572", ["./syz-executor1704889572"], 0x7fff3150b790 /* 10 vars */) = 0 brk(NULL) = 0x555556d8d000 brk(0x555556d8dd40) = 0x555556d8dd40 arch_prctl(ARCH_SET_FS, 0x555556d8d3c0) = 0 set_tid_address(0x555556d8d690) = 293 set_robust_list(0x555556d8d6a0, 24) = 0 rseq(0x555556d8dce0, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlink("/proc/self/exe", "/root/syz-executor1704889572", 4096) = 28 getrandom("\x9e\x64\x49\x73\x92\x7a\xc0\x2c", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x555556d8dd40 brk(0x555556daed40) = 0x555556daed40 brk(0x555556daf000) = 0x555556daf000 mprotect(0x7f0c4a2d4000, 16384, PROT_READ) = 0 mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000 mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000 mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 294 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 295 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 296 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 297 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 298 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 299 ./strace-static-x86_64: Process 299 attached ./strace-static-x86_64: Process 294 attached [pid 299] set_robust_list(0x555556d8d6a0, 24 [pid 294] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 299] <... set_robust_list resumed>) = 0 [pid 294] mkdir("./syzkaller.iF59aB", 0700 [pid 299] mkdir("./syzkaller.o9q2AS", 0700 [pid 294] <... mkdir resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 299] chmod("./syzkaller.o9q2AS", 0777) = 0 [pid 299] chdir("./syzkaller.o9q2AS") = 0 [pid 299] mkdir("./0", 0777) = 0 [pid 294] chmod("./syzkaller.iF59aB", 0777) = 0 [pid 294] chdir("./syzkaller.iF59aB") = 0 [pid 294] mkdir("./0", 0777./strace-static-x86_64: Process 295 attached [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR./strace-static-x86_64: Process 297 attached ./strace-static-x86_64: Process 298 attached ./strace-static-x86_64: Process 296 attached ) = 3 [pid 294] <... mkdir resumed>) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD [pid 299] ioctl(3, LOOP_CLR_FD [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 300 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 301 ./strace-static-x86_64: Process 300 attached [pid 300] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 300] chdir("./0") = 0 [pid 300] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 300] setpgid(0, 0) = 0 [pid 300] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 300] write(3, "1000", 4) = 4 [pid 300] close(3) = 0 [pid 300] symlink("/dev/binderfs", "./binderfs") = 0 [pid 300] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 300] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 300] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 300] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 300] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 300] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 300] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0}./strace-static-x86_64: Process 301 attached [pid 298] set_robust_list(0x555556d8d6a0, 24 [pid 297] set_robust_list(0x555556d8d6a0, 24 [pid 296] set_robust_list(0x555556d8d6a0, 24 [pid 295] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 295] mkdir("./syzkaller.jAi0v3", 0700 [pid 297] <... set_robust_list resumed>) = 0 [pid 297] mkdir("./syzkaller.yAZgI2", 0700 [pid 298] <... set_robust_list resumed>) = 0 [pid 298] mkdir("./syzkaller.qPQybd", 0700 [pid 296] <... set_robust_list resumed>) = 0 [pid 301] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 300] <... clone3 resumed> => {parent_tid=[304]}, 88) = 304 [pid 301] chdir("./0") = 0 [pid 301] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 300] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 304 attached [pid 301] <... prctl resumed>) = 0 [pid 304] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 301] setpgid(0, 0 [pid 304] rt_sigprocmask(SIG_SETMASK, [], [pid 301] <... setpgid resumed>) = 0 [pid 304] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 304] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 301] write(3, "1000", 4) = 4 [pid 301] close(3) = 0 [pid 301] symlink("/dev/binderfs", "./binderfs" [pid 300] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 304] <... futex resumed>) = 0 [pid 301] <... symlink resumed>) = 0 [pid 304] memfd_create("syzkaller", 0 [pid 301] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] <... memfd_create resumed>) = 3 [pid 301] <... futex resumed>) = 0 [pid 304] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 301] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 304] <... mmap resumed>) = 0x7f0c41dee000 [pid 301] <... rt_sigaction resumed>NULL, 8) = 0 [pid 300] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 296] mkdir("./syzkaller.rVgsXW", 0700 [pid 300] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 301] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 300] <... mmap resumed>) = 0x7f0c41dcd000 [pid 304] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 301] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 298] <... mkdir resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 300] <... mprotect resumed>) = 0 [pid 300] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] chmod("./syzkaller.qPQybd", 0777 [pid 297] chmod("./syzkaller.yAZgI2", 0777 [pid 296] chmod("./syzkaller.rVgsXW", 0777 [pid 295] chmod("./syzkaller.jAi0v3", 0777 [pid 304] <... write resumed>) = 262144 [pid 301] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 300] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... chmod resumed>) = 0 [pid 297] <... chmod resumed>) = 0 [pid 296] <... chmod resumed>) = 0 [pid 295] <... chmod resumed>) = 0 [pid 304] munmap(0x7f0c41dee000, 138412032 [pid 301] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 304] <... munmap resumed>) = 0 [pid 301] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 304] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 301] <... mprotect resumed>) = 0 [pid 304] <... openat resumed>) = 4 [pid 301] rt_sigprocmask(SIG_BLOCK, ~[], [pid 300] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 298] chdir("./syzkaller.qPQybd" [pid 297] chdir("./syzkaller.yAZgI2" [pid 296] chdir("./syzkaller.rVgsXW" [pid 295] chdir("./syzkaller.jAi0v3" [pid 298] <... chdir resumed>) = 0 [pid 297] <... chdir resumed>) = 0 [pid 296] <... chdir resumed>) = 0 [pid 295] <... chdir resumed>) = 0 [pid 300] <... clone3 resumed> => {parent_tid=[305]}, 88) = 305 [pid 298] mkdir("./0", 0777 [pid 297] mkdir("./0", 0777 [pid 296] mkdir("./0", 0777 [pid 295] mkdir("./0", 0777 [pid 300] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... mkdir resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 300] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 300] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 300] <... futex resumed>) = 0 [pid 300] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] ioctl(3, LOOP_CLR_FD [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] ioctl(3, LOOP_CLR_FD [pid 298] close(3 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] <... close resumed>) = 0 [pid 297] close(3 [pid 296] close(3 [pid 295] close(3 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... close resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 307 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 308 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 309 [ 22.169006][ T30] audit: type=1400 audit(1703527012.396:66): avc: denied { execmem } for pid=293 comm="syz-executor170" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 22.176030][ T30] audit: type=1400 audit(1703527012.396:67): avc: denied { read write } for pid=299 comm="syz-executor170" name="loop5" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 22.183793][ T30] audit: type=1400 audit(1703527012.396:68): avc: denied { open } for pid=299 comm="syz-executor170" path="/dev/loop5" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 310 ./strace-static-x86_64: Process 309 attached [pid 309] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 309] chdir("./0") = 0 [pid 309] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 309] setpgid(0, 0) = 0 [pid 309] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 309] write(3, "1000", 4) = 4 [pid 309] close(3) = 0 [pid 309] symlink("/dev/binderfs", "./binderfs") = 0 [pid 309] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] ioctl(4, LOOP_SET_FD, 3 [pid 301] <... rt_sigprocmask resumed>[], 8) = 0 ./strace-static-x86_64: Process 310 attached ./strace-static-x86_64: Process 308 attached ./strace-static-x86_64: Process 307 attached ./strace-static-x86_64: Process 305 attached [pid 309] <... futex resumed>) = 0 [pid 304] <... ioctl resumed>) = 0 [pid 301] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 310] set_robust_list(0x555556d8d6a0, 24 [pid 309] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 308] set_robust_list(0x555556d8d6a0, 24 [pid 307] set_robust_list(0x555556d8d6a0, 24 [pid 305] set_robust_list(0x7f0c41ded9a0, 24 [pid 304] close(3 [pid 310] <... set_robust_list resumed>) = 0 [pid 309] <... rt_sigaction resumed>NULL, 8) = 0 [pid 308] <... set_robust_list resumed>) = 0 [pid 307] <... set_robust_list resumed>) = 0 [pid 305] <... set_robust_list resumed>) = 0 [pid 304] <... close resumed>) = 0 [pid 301] <... clone3 resumed> => {parent_tid=[311]}, 88) = 311 [pid 310] chdir("./0" [pid 309] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 308] chdir("./0" [pid 307] chdir("./0" [pid 305] rt_sigprocmask(SIG_SETMASK, [], [pid 304] mkdir("./file1", 0777 [pid 301] rt_sigprocmask(SIG_SETMASK, [], [pid 310] <... chdir resumed>) = 0 [pid 309] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 308] <... chdir resumed>) = 0 [pid 307] <... chdir resumed>) = 0 [pid 305] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 310] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 309] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 308] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 307] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 305] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 304] <... mkdir resumed>) = 0 [pid 301] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... prctl resumed>) = 0 [pid 309] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 308] <... prctl resumed>) = 0 [pid 307] <... prctl resumed>) = 0 [pid 305] <... open resumed>) = 3 [pid 304] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 301] <... futex resumed>) = 0 ./strace-static-x86_64: Process 311 attached [pid 310] setpgid(0, 0 [pid 309] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 308] setpgid(0, 0 [pid 307] setpgid(0, 0 [pid 305] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] set_robust_list(0x7f0c4a20e9a0, 24 [pid 309] <... mprotect resumed>) = 0 [pid 301] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] <... set_robust_list resumed>) = 0 [pid 310] <... setpgid resumed>) = 0 [pid 309] rt_sigprocmask(SIG_BLOCK, ~[], [pid 308] <... setpgid resumed>) = 0 [pid 307] <... setpgid resumed>) = 0 [pid 305] <... futex resumed>) = 1 [pid 301] <... futex resumed>) = 0 [pid 300] <... futex resumed>) = 0 [pid 311] rt_sigprocmask(SIG_SETMASK, [], [pid 309] <... rt_sigprocmask resumed>[], 8) = 0 [pid 300] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 309] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 300] <... futex resumed>) = 0 [pid 311] memfd_create("syzkaller", 0 [pid 300] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 311] <... memfd_create resumed>) = 3 [pid 309] <... clone3 resumed> => {parent_tid=[312]}, 88) = 312 [pid 311] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 309] rt_sigprocmask(SIG_SETMASK, [], [pid 311] <... mmap resumed>) = 0x7f0c41dee000 [pid 309] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 311] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 309] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] <... write resumed>) = 262144 [pid 309] <... futex resumed>) = 0 [pid 309] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 309] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 309] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 311] munmap(0x7f0c41dee000, 138412032 [pid 309] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 311] <... munmap resumed>) = 0 [pid 311] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 309] <... clone3 resumed> => {parent_tid=[313]}, 88) = 313 ./strace-static-x86_64: Process 312 attached [pid 311] <... openat resumed>) = 4 [pid 309] rt_sigprocmask(SIG_SETMASK, [], [pid 312] set_robust_list(0x7f0c4a20e9a0, 24 [pid 311] ioctl(4, LOOP_SET_FD, 3 [pid 309] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 22.204973][ T30] audit: type=1400 audit(1703527012.396:69): avc: denied { ioctl } for pid=294 comm="syz-executor170" path="/dev/loop0" dev="devtmpfs" ino=112 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 22.231107][ T304] loop5: detected capacity change from 0 to 512 [ 22.244355][ T30] audit: type=1400 audit(1703527012.466:70): avc: denied { mounton } for pid=300 comm="syz-executor170" path="/root/syzkaller.o9q2AS/0/bus" dev="sda1" ino=1943 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=file permissive=1 [pid 312] <... set_robust_list resumed>) = 0 [pid 310] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 309] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 307] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 305] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 301] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 312] rt_sigprocmask(SIG_SETMASK, [], [pid 310] <... openat resumed>) = 3 [pid 309] <... futex resumed>) = 0 [pid 308] <... openat resumed>) = 3 [pid 307] <... openat resumed>) = 3 [pid 305] <... mount resumed>) = 0 [pid 301] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 312] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 310] write(3, "1000", 4 [pid 309] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] write(3, "1000", 4 [pid 307] write(3, "1000", 4 [pid 305] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE./strace-static-x86_64: Process 313 attached [pid 312] memfd_create("syzkaller", 0 [pid 310] <... write resumed>) = 4 [pid 308] <... write resumed>) = 4 [pid 307] <... write resumed>) = 4 [pid 305] <... futex resumed>) = 1 [pid 301] <... mprotect resumed>) = 0 [pid 300] <... futex resumed>) = 0 [pid 313] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 312] <... memfd_create resumed>) = 3 [pid 300] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] <... set_robust_list resumed>) = 0 [pid 312] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 300] <... futex resumed>) = 0 [pid 313] rt_sigprocmask(SIG_SETMASK, [], [pid 312] <... mmap resumed>) = 0x7f0c41dcd000 [pid 300] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 313] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 312] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 310] close(3 [pid 308] close(3 [pid 307] close(3 [pid 305] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 301] rt_sigprocmask(SIG_BLOCK, ~[], [pid 313] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 312] <... write resumed>) = 262144 [pid 310] <... close resumed>) = 0 [pid 308] <... close resumed>) = 0 [pid 307] <... close resumed>) = 0 [pid 305] <... open resumed>) = 5 [pid 301] <... rt_sigprocmask resumed>[], 8) = 0 [pid 313] <... open resumed>) = 4 [pid 312] munmap(0x7f0c41dcd000, 138412032 [pid 310] symlink("/dev/binderfs", "./binderfs" [pid 308] symlink("/dev/binderfs", "./binderfs" [pid 307] symlink("/dev/binderfs", "./binderfs" [pid 305] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 313] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] <... munmap resumed>) = 0 [pid 311] <... ioctl resumed>) = 0 [pid 310] <... symlink resumed>) = 0 [pid 308] <... symlink resumed>) = 0 [pid 307] <... symlink resumed>) = 0 [pid 305] <... futex resumed>) = 1 [pid 300] <... futex resumed>) = 0 [pid 311] close(3 [pid 310] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 301] <... clone3 resumed> => {parent_tid=[317]}, 88) = 317 [pid 311] <... close resumed>) = 0 [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 301] rt_sigprocmask(SIG_SETMASK, [], [pid 311] mkdir("./file1", 0777 [pid 310] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 308] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 307] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 301] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 311] <... mkdir resumed>) = 0 [pid 310] <... rt_sigaction resumed>NULL, 8) = 0 [pid 308] <... rt_sigaction resumed>NULL, 8) = 0 [pid 307] <... rt_sigaction resumed>NULL, 8) = 0 [pid 301] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [ 22.255856][ T311] loop0: detected capacity change from 0 to 512 [ 22.286993][ T304] EXT4-fs (loop5): 1 orphan inode deleted [ 22.289618][ T30] audit: type=1400 audit(1703527012.516:71): avc: denied { mounton } for pid=301 comm="syz-executor170" path="/root/syzkaller.iF59aB/0/file1" dev="sda1" ino=1948 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [pid 310] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 308] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 307] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 301] <... futex resumed>) = 0 [pid 313] <... futex resumed>) = 1 [pid 312] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 310] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 309] <... futex resumed>) = 0 [pid 308] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 307] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 308] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 307] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 310] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 308] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 307] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 310] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 308] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 307] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 310] <... mprotect resumed>) = 0 [pid 308] <... mprotect resumed>) = 0 [pid 307] <... mprotect resumed>) = 0 [pid 310] rt_sigprocmask(SIG_BLOCK, ~[], [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [pid 310] <... rt_sigprocmask resumed>[], 8) = 0 [pid 308] <... rt_sigprocmask resumed>[], 8) = 0 [pid 307] <... rt_sigprocmask resumed>[], 8) = 0 [pid 310] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 308] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 307] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 310] <... clone3 resumed> => {parent_tid=[318]}, 88) = 318 [pid 308] <... clone3 resumed> => {parent_tid=[319]}, 88) = 319 [pid 307] <... clone3 resumed> => {parent_tid=[320]}, 88) = 320 [pid 310] rt_sigprocmask(SIG_SETMASK, [], [pid 308] rt_sigprocmask(SIG_SETMASK, [], [pid 307] rt_sigprocmask(SIG_SETMASK, [], [pid 310] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 308] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 307] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 310] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 310] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 310] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 308] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 307] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 310] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 308] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 307] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 310] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 308] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 307] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 310] <... mprotect resumed>) = 0 [pid 308] <... mprotect resumed>) = 0 [pid 307] <... mprotect resumed>) = 0 [pid 310] rt_sigprocmask(SIG_BLOCK, ~[], [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [pid 310] <... rt_sigprocmask resumed>[], 8) = 0 [pid 308] <... rt_sigprocmask resumed>[], 8) = 0 [pid 307] <... rt_sigprocmask resumed>[], 8) = 0 [pid 310] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 308] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 307] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 310] <... clone3 resumed> => {parent_tid=[321]}, 88) = 321 [pid 308] <... clone3 resumed> => {parent_tid=[322]}, 88) = 322 [pid 307] <... clone3 resumed> => {parent_tid=[323]}, 88) = 323 [pid 310] rt_sigprocmask(SIG_SETMASK, [], [pid 308] rt_sigprocmask(SIG_SETMASK, [], [pid 307] rt_sigprocmask(SIG_SETMASK, [], [pid 310] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 308] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 307] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 310] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 310] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 317 attached [pid 317] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 317] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 317] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 317] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... futex resumed>) = 0 [pid 301] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 301] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] <... futex resumed>) = 1 [pid 317] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 317] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... futex resumed>) = 0 [pid 301] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 301] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] <... futex resumed>) = 1 [pid 317] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 317] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] <... futex resumed>) = 0 [pid 301] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 301] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] <... futex resumed>) = 1 [pid 317] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 309] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... futex resumed>) = 1 [pid 305] <... futex resumed>) = 0 [pid 313] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 305] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 309] <... futex resumed>) = 0 [pid 300] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 309] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 305] <... write resumed>) = 8 ./strace-static-x86_64: Process 318 attached [pid 313] <... mount resumed>) = 0 [pid 305] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 300] <... futex resumed>) = 0 [pid 313] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 313] <... futex resumed>) = 1 [pid 309] <... futex resumed>) = 0 [pid 318] set_robust_list(0x7f0c4a20e9a0, 24 [pid 309] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 300] <... futex resumed>) = 0 [pid 318] <... set_robust_list resumed>) = 0 [pid 309] <... futex resumed>) = 0 [pid 300] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 309] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 318] rt_sigprocmask(SIG_SETMASK, [], [pid 313] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 305] <... write resumed>) = 1045 [pid 318] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 305] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 313] <... open resumed>) = 6 [pid 318] memfd_create("syzkaller", 0) = 3 [pid 305] <... futex resumed>) = 1 [pid 300] <... futex resumed>) = 0 [pid 313] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 305] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 318] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 313] <... futex resumed>) = 1 [pid 309] <... futex resumed>) = 0 [pid 309] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 312] <... openat resumed>) = 5 [pid 313] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 309] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 313] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 313] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 312] ioctl(5, LOOP_SET_FD, 3 [pid 313] <... futex resumed>) = 1 [pid 309] <... futex resumed>) = 0 [pid 309] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 309] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 318] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 318] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 318] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 318] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 323 attached ./strace-static-x86_64: Process 322 attached ./strace-static-x86_64: Process 321 attached ./strace-static-x86_64: Process 320 attached ./strace-static-x86_64: Process 319 attached [pid 317] <... write resumed>) = 8 [pid 313] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 318] <... ioctl resumed>) = 0 [pid 318] close(3) = 0 [pid 318] mkdir("./file1", 0777) = 0 [ 22.293125][ T304] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.333454][ T312] loop2: detected capacity change from 0 to 512 [ 22.336947][ T318] loop1: detected capacity change from 0 to 512 [ 22.342396][ T311] EXT4-fs (loop0): 1 orphan inode deleted [pid 318] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 310] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 313] <... write resumed>) = -1 EIO (Input/output error) [pid 310] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 307] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 301] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 310] <... futex resumed>) = 0 [pid 308] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 301] <... futex resumed>) = 0 [pid 310] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 308] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 307] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 301] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 310] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 308] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 307] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 301] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 310] <... mprotect resumed>) = 0 [pid 308] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 307] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 301] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 310] rt_sigprocmask(SIG_BLOCK, ~[], [pid 308] <... mprotect resumed>) = 0 [pid 307] <... mprotect resumed>) = 0 [pid 301] <... mprotect resumed>) = 0 [pid 310] <... rt_sigprocmask resumed>[], 8) = 0 [pid 308] rt_sigprocmask(SIG_BLOCK, ~[], [pid 307] rt_sigprocmask(SIG_BLOCK, ~[], [pid 301] rt_sigprocmask(SIG_BLOCK, ~[], [pid 310] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 308] <... rt_sigprocmask resumed>[], 8) = 0 [pid 307] <... rt_sigprocmask resumed>[], 8) = 0 [pid 301] <... rt_sigprocmask resumed>[], 8) = 0 [pid 308] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 307] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 301] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 308] <... clone3 resumed> => {parent_tid=[329]}, 88) = 329 [pid 307] <... clone3 resumed> => {parent_tid=[328]}, 88) = 328 [pid 301] <... clone3 resumed> => {parent_tid=[330]}, 88) = 330 [pid 310] <... clone3 resumed> => {parent_tid=[327]}, 88) = 327 [pid 308] rt_sigprocmask(SIG_SETMASK, [], [pid 307] rt_sigprocmask(SIG_SETMASK, [], [pid 301] rt_sigprocmask(SIG_SETMASK, [], [pid 310] rt_sigprocmask(SIG_SETMASK, [], [pid 308] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 307] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 301] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 310] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 308] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 301] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 301] <... futex resumed>) = 0 [pid 310] <... futex resumed>) = 0 [pid 308] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 301] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 310] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 317] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 317] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 322] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 321] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 320] set_robust_list(0x7f0c4a20e9a0, 24 [pid 319] set_robust_list(0x7f0c4a20e9a0, 24 [pid 322] <... set_robust_list resumed>) = 0 [pid 321] <... set_robust_list resumed>) = 0 [pid 320] <... set_robust_list resumed>) = 0 [pid 323] <... set_robust_list resumed>) = 0 [pid 319] <... set_robust_list resumed>) = 0 [pid 322] rt_sigprocmask(SIG_SETMASK, [], [pid 321] rt_sigprocmask(SIG_SETMASK, [], [pid 320] rt_sigprocmask(SIG_SETMASK, [], [pid 323] rt_sigprocmask(SIG_SETMASK, [], [pid 319] rt_sigprocmask(SIG_SETMASK, [], [pid 322] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 321] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 320] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 323] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 319] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 321] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 322] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 320] memfd_create("syzkaller", 0 [pid 323] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 322] <... open resumed>) = 3 [pid 321] <... open resumed>) = 3 [pid 319] memfd_create("syzkaller", 0 [pid 323] <... open resumed>) = 3 [pid 322] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 321] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 320] <... memfd_create resumed>) = 4 [pid 319] <... memfd_create resumed>) = 4 [pid 312] <... ioctl resumed>) = 0 [pid 313] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 309] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 313] <... futex resumed>) = 0 [pid 323] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 322] <... futex resumed>) = 0 [pid 321] <... futex resumed>) = 0 [pid 320] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 319] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 312] close(3 [pid 323] <... futex resumed>) = 0 [pid 322] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 321] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 320] <... mmap resumed>) = 0x7f0c41dac000 [pid 319] <... mmap resumed>) = 0x7f0c41dac000 [pid 313] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 312] <... close resumed>) = 0 [pid 320] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 319] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [ 22.348074][ T30] audit: type=1400 audit(1703527012.576:72): avc: denied { mount } for pid=300 comm="syz-executor170" name="/" dev="loop5" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 22.351626][ T54] blk_update_request: I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 22.384098][ T304] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/0/bus supports timestamps until 2038 (0x7fffffff) [ 22.401543][ T318] EXT4-fs (loop1): 1 orphan inode deleted [ 22.403377][ T320] loop4: detected capacity change from 0 to 512 [pid 312] mkdir("./bus", 0777 [pid 323] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 330 attached ./strace-static-x86_64: Process 329 attached ./strace-static-x86_64: Process 328 attached ./strace-static-x86_64: Process 327 attached [pid 320] <... write resumed>) = 262144 [pid 319] <... write resumed>) = 262144 [pid 312] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 320] munmap(0x7f0c41dac000, 138412032) = 0 [pid 319] munmap(0x7f0c41dac000, 138412032 [pid 320] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 319] <... munmap resumed>) = 0 [pid 320] <... openat resumed>) = 5 [pid 319] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 320] ioctl(5, LOOP_SET_FD, 4 [pid 319] <... openat resumed>) = 5 [pid 319] ioctl(5, LOOP_SET_FD, 4 [pid 330] set_robust_list(0x7f0c4a1cc9a0, 24 [pid 329] set_robust_list(0x7f0c4a1cc9a0, 24 [pid 328] set_robust_list(0x7f0c4a1cc9a0, 24 [pid 327] set_robust_list(0x7f0c4a1cc9a0, 24 [pid 312] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 310] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 308] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 307] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 301] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 310] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... futex resumed>) = 0 [pid 322] <... futex resumed>) = 0 [pid 321] <... futex resumed>) = 0 [pid 310] <... futex resumed>) = 1 [pid 308] <... futex resumed>) = 1 [pid 307] <... futex resumed>) = 1 [pid 323] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 322] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 321] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 310] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 323] <... open resumed>) = 6 [pid 322] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 321] <... open resumed>) = 5 [pid 323] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 322] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 321] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... futex resumed>) = 1 [pid 322] <... futex resumed>) = 1 [pid 321] <... futex resumed>) = 1 [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 323] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 322] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 321] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 310] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 307] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 322] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 321] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 323] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 322] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 321] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 310] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 308] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 322] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 330] <... set_robust_list resumed>) = 0 [pid 329] <... set_robust_list resumed>) = 0 [pid 328] <... set_robust_list resumed>) = 0 [pid 327] <... set_robust_list resumed>) = 0 [pid 322] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 330] rt_sigprocmask(SIG_SETMASK, [], [pid 329] rt_sigprocmask(SIG_SETMASK, [], [pid 328] rt_sigprocmask(SIG_SETMASK, [], [pid 327] rt_sigprocmask(SIG_SETMASK, [], [pid 322] <... futex resumed>) = 1 [pid 308] <... futex resumed>) = 0 [pid 330] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 329] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 328] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 327] <... rt_sigprocmask resumed>NULL, 8) = 0 [ 22.407106][ T318] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.407192][ T318] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/0/file1 supports timestamps until 2038 (0x7fffffff) [ 22.413523][ T319] loop3: detected capacity change from 0 to 512 [ 22.435435][ T311] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.435537][ T311] ext4 filesystem being mounted at /root/syzkaller.iF59aB/0/file1 supports timestamps until 2038 (0x7fffffff) [pid 323] <... write resumed>) = 8 [pid 322] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 321] <... write resumed>) = 8 [pid 320] <... ioctl resumed>) = 0 [pid 319] <... ioctl resumed>) = 0 [pid 318] <... mount resumed>) = 0 [pid 311] <... mount resumed>) = 0 [pid 308] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 330] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 329] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 328] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 327] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 323] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 322] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 321] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 320] close(4 [pid 319] close(4 [pid 318] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 311] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 329] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 328] <... mount resumed>) = 0 [pid 323] <... futex resumed>) = 1 [pid 321] <... futex resumed>) = 1 [pid 320] <... close resumed>) = 0 [pid 322] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 319] <... close resumed>) = 0 [pid 318] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 311] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = 0 [pid 307] <... futex resumed>) = 0 [pid 327] <... mount resumed>) = 0 [pid 304] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 330] <... write resumed>) = 1045 [pid 329] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 328] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 327] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 323] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 322] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 321] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 320] mkdir("./bus", 0777 [pid 319] mkdir("./file1", 0777 [pid 318] ioctl(4, LOOP_CLR_FD [pid 311] ioctl(4, LOOP_CLR_FD [pid 310] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 308] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] ioctl(4, LOOP_CLR_FD [pid 330] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 329] <... futex resumed>) = 0 [pid 328] <... futex resumed>) = 0 [pid 327] <... futex resumed>) = 0 [pid 323] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 322] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 321] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 320] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 319] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 318] <... ioctl resumed>) = 0 [pid 311] <... ioctl resumed>) = 0 [pid 304] <... ioctl resumed>) = 0 [pid 330] <... futex resumed>) = 0 [pid 329] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 328] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 327] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 322] <... futex resumed>) = 0 [pid 321] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 320] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 319] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 318] close(4 [pid 311] close(4 [pid 310] <... futex resumed>) = 0 [pid 308] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 307] <... futex resumed>) = 0 [pid 304] close(4 [pid 330] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 322] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 318] <... close resumed>) = 0 [pid 311] <... close resumed>) = 0 [pid 304] <... close resumed>) = 0 [pid 318] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 311] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 304] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 318] <... futex resumed>) = 0 [pid 311] <... futex resumed>) = 0 [pid 304] <... futex resumed>) = 0 [pid 318] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 311] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 304] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 323] <... write resumed>) = 1045 [pid 321] <... write resumed>) = 1045 [pid 310] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 307] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 300] exit_group(0 [pid 323] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 321] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 310] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 307] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 301] exit_group(0 [pid 323] <... futex resumed>) = 0 [pid 300] <... exit_group resumed>) = ? [pid 321] <... futex resumed>) = 0 [pid 310] exit_group(0 [pid 330] <... futex resumed>) = ? [pid 323] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 317] <... futex resumed>) = ? [pid 310] <... exit_group resumed>) = ? [pid 327] <... futex resumed>) = ? [pid 301] <... exit_group resumed>) = ? [pid 330] +++ exited with 0 +++ [pid 327] +++ exited with 0 +++ [pid 318] <... futex resumed>) = ? [pid 317] +++ exited with 0 +++ [pid 311] <... futex resumed>) = ? [pid 305] <... futex resumed>) = ? [pid 304] <... futex resumed>) = ? [pid 321] +++ exited with 0 +++ [pid 318] +++ exited with 0 +++ [pid 311] +++ exited with 0 +++ [pid 310] +++ exited with 0 +++ [pid 305] +++ exited with 0 +++ [pid 301] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=310, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=301, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [ 22.464231][ T30] audit: type=1400 audit(1703527012.686:73): avc: denied { mounton } for pid=309 comm="syz-executor170" path="/root/syzkaller.rVgsXW/0/bus" dev="devtmpfs" ino=114 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 22.496443][ T312] EXT4-fs (loop2): 1 orphan inode deleted [ 22.503410][ T312] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 294] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 22.522938][ T320] EXT4-fs (loop4): 1 orphan inode deleted [ 22.526341][ T312] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/0/bus supports timestamps until 2038 (0x7fffffff) [ 22.530731][ T319] EXT4-fs (loop3): 1 orphan inode deleted [ 22.540712][ T320] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.546280][ T319] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 294] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 294] newfstatat(3, "", [pid 312] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 295] newfstatat(3, "", [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 312] ioctl(5, LOOP_CLR_FD [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(3, [pid 312] <... ioctl resumed>) = 0 [pid 295] getdents64(3, [pid 294] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 312] close(5 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 312] <... close resumed>) = 0 [pid 304] +++ exited with 0 +++ [pid 300] +++ exited with 0 +++ [pid 295] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 295] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./0/bus", [pid 294] newfstatat(AT_FDCWD, "./0/bus", [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=1053, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./0/bus" [pid 294] unlink("./0/bus" [pid 295] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 295] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=300, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 295] newfstatat(AT_FDCWD, "./0/binderfs", [pid 294] newfstatat(AT_FDCWD, "./0/binderfs", [pid 312] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 312] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 309] exit_group(0 [pid 295] unlink("./0/binderfs" [pid 294] unlink("./0/binderfs" [pid 313] <... futex resumed>) = ? [pid 309] <... exit_group resumed>) = ? [pid 295] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 313] +++ exited with 0 +++ [pid 312] <... futex resumed>) = ? [pid 295] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 299] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 299] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./0/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 22.567130][ T320] ext4 filesystem being mounted at /root/syzkaller.qPQybd/0/bus supports timestamps until 2038 (0x7fffffff) [ 22.567507][ T319] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/0/file1 supports timestamps until 2038 (0x7fffffff) [ 22.582864][ T30] audit: type=1400 audit(1703527012.806:74): avc: denied { unmount } for pid=294 comm="syz-executor170" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [pid 299] unlink("./0/bus") = 0 [pid 299] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./0/binderfs") = 0 [pid 299] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./0/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 299] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./0/file1") = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./0") = 0 [pid 299] mkdir("./1", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 340 ./strace-static-x86_64: Process 340 attached [pid 340] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 340] chdir("./1") = 0 [pid 340] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 340] setpgid(0, 0) = 0 [pid 340] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 340] write(3, "1000", 4) = 4 [pid 340] close(3) = 0 [pid 340] symlink("/dev/binderfs", "./binderfs") = 0 [pid 340] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 319] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 319] ioctl(5, LOOP_CLR_FD [pid 320] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 340] <... futex resumed>) = 0 [pid 340] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 340] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 320] ioctl(5, LOOP_CLR_FD [pid 340] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 340] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 340] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 340] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 340] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0}./strace-static-x86_64: Process 341 attached => {parent_tid=[341]}, 88) = 341 [pid 341] set_robust_list(0x7f0c4a20e9a0, 24 [pid 340] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 340] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] <... set_robust_list resumed>) = 0 [pid 340] <... futex resumed>) = 0 [pid 340] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 341] rt_sigprocmask(SIG_SETMASK, [], [pid 340] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 340] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 341] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 340] <... mprotect resumed>) = 0 [pid 340] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 341] memfd_create("syzkaller", 0) = 3 [pid 340] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0}./strace-static-x86_64: Process 342 attached [pid 341] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 340] <... clone3 resumed> => {parent_tid=[342]}, 88) = 342 [pid 340] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 340] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 340] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 342] rt_sigprocmask(SIG_SETMASK, [], [pid 341] <... mmap resumed>) = 0x7f0c41dcd000 [pid 342] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 342] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 [pid 342] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] <... futex resumed>) = 0 [pid 340] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 340] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 1 [pid 342] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 342] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] <... futex resumed>) = 0 [pid 342] <... futex resumed>) = 1 [pid 340] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 340] <... futex resumed>) = 0 [pid 342] <... open resumed>) = 5 [pid 340] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 341] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 342] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 340] <... futex resumed>) = 0 [pid 342] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 340] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 340] <... futex resumed>) = 0 [pid 342] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 0 [pid 340] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 342] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 340] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 342] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 340] <... futex resumed>) = 0 [pid 342] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 340] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 342] <... futex resumed>) = 0 [pid 340] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 342] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 341] <... write resumed>) = 262144 [pid 341] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 341] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 6 [pid 341] ioctl(6, LOOP_SET_FD, 3 [pid 312] +++ exited with 0 +++ [pid 309] +++ exited with 0 +++ [pid 294] <... umount2 resumed>) = 0 [pid 294] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=309, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./0/file1", [pid 341] <... ioctl resumed>) = 0 [pid 341] close(3) = 0 [pid 341] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 341] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 296] <... restart_syscall resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./0/file1", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] newfstatat(3, "", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] openat(AT_FDCWD, "./0/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... openat resumed>) = 4 [pid 295] <... openat resumed>) = 4 [pid 296] getdents64(3, [pid 295] newfstatat(4, "", [pid 294] newfstatat(4, "", [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] getdents64(4, [pid 294] getdents64(4, [pid 296] <... umount2 resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] getdents64(4, [pid 294] getdents64(4, [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] newfstatat(AT_FDCWD, "./0/bus", [pid 295] close(4 [pid 294] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... close resumed>) = 0 [pid 294] close(4 [pid 296] unlink("./0/bus" [pid 295] rmdir("./0/file1" [pid 296] <... unlink resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 296] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] getdents64(3, [pid 294] rmdir("./0/file1" [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./0" [pid 296] newfstatat(AT_FDCWD, "./0/binderfs", [pid 294] <... rmdir resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 294] getdents64(3, [pid 296] unlink("./0/binderfs" [pid 295] mkdir("./1", 0777 [pid 296] <... unlink resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] getdents64(3, [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3 [pid 295] close(3 [pid 296] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 296] rmdir("./0" [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... rmdir resumed>) = 0 [pid 294] close(3 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 343 [pid 296] mkdir("./1", 0777 [pid 294] <... close resumed>) = 0 ./strace-static-x86_64: Process 343 attached [pid 343] set_robust_list(0x555556d8d6a0, 24 [pid 320] <... ioctl resumed>) = 0 [pid 343] <... set_robust_list resumed>) = 0 [pid 319] <... ioctl resumed>) = 0 [pid 319] close(5 [pid 320] close(5) = 0 [pid 319] <... close resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [ 22.620857][ T30] audit: type=1400 audit(1703527012.846:75): avc: denied { unmount } for pid=295 comm="syz-executor170" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 22.660890][ T341] loop5: detected capacity change from 0 to 512 [pid 294] rmdir("./0" [pid 320] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 319] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 294] <... rmdir resumed>) = 0 [pid 320] <... futex resumed>) = 0 [pid 319] <... futex resumed>) = 0 [pid 320] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 319] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] mkdir("./1", 0777 [pid 296] <... openat resumed>) = 3 [pid 308] exit_group(0 [pid 307] exit_group(0 [pid 328] <... futex resumed>) = ? [pid 308] <... exit_group resumed>) = ? [pid 307] <... exit_group resumed>) = ? [pid 329] <... futex resumed>) = ? [pid 322] <... futex resumed>) = ? [pid 328] +++ exited with 0 +++ [pid 323] <... futex resumed>) = ? [pid 329] +++ exited with 0 +++ [pid 323] +++ exited with 0 +++ [pid 322] +++ exited with 0 +++ [pid 294] <... mkdir resumed>) = 0 [pid 319] <... futex resumed>) = 0 [pid 320] <... futex resumed>) = ? [pid 296] ioctl(3, LOOP_CLR_FD [pid 343] chdir("./1" [pid 319] +++ exited with 0 +++ [pid 308] +++ exited with 0 +++ [pid 343] <... chdir resumed>) = 0 [pid 320] +++ exited with 0 +++ [pid 307] +++ exited with 0 +++ [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=307, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=308, si_uid=0, si_status=0, si_utime=0, si_stime=10} --- [pid 296] close(3 [pid 294] <... openat resumed>) = 3 [pid 296] <... close resumed>) = 0 [pid 297] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] ioctl(3, LOOP_CLR_FD [pid 298] umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 343] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 346 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... openat resumed>) = 3 [pid 294] close(3 [pid 298] <... openat resumed>) = 3 [pid 297] newfstatat(3, "", [pid 294] <... close resumed>) = 0 [pid 298] newfstatat(3, "", [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] getdents64(3, [pid 298] getdents64(3, [pid 343] <... prctl resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 347 [pid 298] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] umount2("./0/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] newfstatat(AT_FDCWD, "./0/binderfs", [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] newfstatat(AT_FDCWD, "./0/bus", [pid 297] unlink("./0/binderfs" [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=1053, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... unlink resumed>) = 0 [pid 298] unlink("./0/bus" [pid 297] umount2("./0/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... unlink resumed>) = 0 [pid 298] umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./0/file1", [pid 298] newfstatat(AT_FDCWD, "./0/binderfs", [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./0/file1" [pid 298] unlink("./0/binderfs" [pid 297] <... unlink resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 297] getdents64(3, [pid 298] getdents64(3, [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 347 attached [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] close(3./strace-static-x86_64: Process 346 attached [pid 346] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 298] close(3 [pid 297] <... close resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 297] rmdir("./0" [pid 298] rmdir("./0" [pid 346] chdir("./1") = 0 [pid 346] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 346] setpgid(0, 0 [pid 297] <... rmdir resumed>) = 0 [pid 346] <... setpgid resumed>) = 0 [pid 346] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] <... rmdir resumed>) = 0 [pid 297] mkdir("./1", 0777 [pid 298] mkdir("./1", 0777 [pid 346] <... openat resumed>) = 3 [pid 346] write(3, "1000", 4) = 4 [pid 297] <... mkdir resumed>) = 0 [pid 346] close(3) = 0 [pid 346] symlink("/dev/binderfs", "./binderfs") = 0 [pid 298] <... mkdir resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 297] <... openat resumed>) = 3 [pid 298] <... openat resumed>) = 3 [pid 297] ioctl(3, LOOP_CLR_FD [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] close(3 [pid 297] close(3 [pid 346] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 346] <... futex resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 346] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 346] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 346] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 346] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 346] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 348 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 349 [pid 346] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[350]}, 88) = 350 [pid 346] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 346] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 346] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 346] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 347] set_robust_list(0x555556d8d6a0, 24 [pid 346] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 343] setpgid(0, 0 [pid 346] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE./strace-static-x86_64: Process 348 attached ) = 0 [pid 348] set_robust_list(0x555556d8d6a0, 24 [pid 346] rt_sigprocmask(SIG_BLOCK, ~[], [pid 348] <... set_robust_list resumed>) = 0 [pid 346] <... rt_sigprocmask resumed>[], 8) = 0 [pid 348] chdir("./1" [pid 346] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 348] <... chdir resumed>) = 0 [pid 348] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 346] <... clone3 resumed> => {parent_tid=[351]}, 88) = 351 [pid 348] <... prctl resumed>) = 0 [pid 346] rt_sigprocmask(SIG_SETMASK, [], [pid 348] setpgid(0, 0 [pid 346] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 348] <... setpgid resumed>) = 0 [pid 346] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 348] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 346] <... futex resumed>) = 0 [pid 348] <... openat resumed>) = 3 [pid 346] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 347] <... set_robust_list resumed>) = 0 [pid 348] write(3, "1000", 4 [pid 343] <... setpgid resumed>) = 0 [pid 348] <... write resumed>) = 4 [pid 348] close(3) = 0 [pid 348] symlink("/dev/binderfs", "./binderfs" [pid 347] chdir("./1" [pid 348] <... symlink resumed>) = 0 [pid 347] <... chdir resumed>) = 0 [pid 343] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 348] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 348] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 348] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 348] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 348] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 348] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 348] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[352]}, 88) = 352 [pid 348] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 348] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 348] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 348] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 348] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 348] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 348] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[353]}, 88) = 353 [pid 348] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 348] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 348] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 349 attached [pid 349] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 349] chdir("./1") = 0 [pid 349] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 349] setpgid(0, 0) = 0 [pid 349] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 349] write(3, "1000", 4) = 4 [pid 349] close(3) = 0 [pid 349] symlink("/dev/binderfs", "./binderfs") = 0 [pid 349] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 349] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 349] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 349] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 349] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 349] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[354]}, 88) = 354 [pid 349] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 349] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 349] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 349] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 349] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[355]}, 88) = 355 [pid 349] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 349] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 349] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 354 attached [pid 354] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 354] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 354] memfd_create("syzkaller", 0) = 3 [pid 354] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 354] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 347] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 343] <... openat resumed>) = 3 [pid 347] <... prctl resumed>) = 0 [pid 354] <... write resumed>) = 262144 [ 22.683193][ T341] EXT4-fs (loop5): 1 orphan inode deleted [ 22.706813][ T341] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.720398][ T354] loop3: detected capacity change from 0 to 512 [pid 354] munmap(0x7f0c41dcd000, 138412032 [pid 347] setpgid(0, 0 [pid 343] write(3, "1000", 4 [pid 347] <... setpgid resumed>) = 0 [pid 354] <... munmap resumed>) = 0 [pid 354] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 354] ioctl(4, LOOP_SET_FD, 3 [pid 347] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 343] <... write resumed>) = 4 [pid 354] <... ioctl resumed>) = 0 [pid 354] close(3) = 0 [pid 354] mkdir("./file1", 0777) = 0 [pid 354] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 351 attached ./strace-static-x86_64: Process 350 attached [pid 347] <... openat resumed>) = 3 [pid 347] write(3, "1000", 4 [pid 343] close(3 [pid 347] <... write resumed>) = 4 [pid 343] <... close resumed>) = 0 [pid 347] close(3) = 0 [pid 343] symlink("/dev/binderfs", "./binderfs") = 0 [pid 347] symlink("/dev/binderfs", "./binderfs") = 0 [pid 347] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 347] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 343] <... futex resumed>) = 0 [pid 347] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 343] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 347] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 343] <... rt_sigaction resumed>NULL, 8) = 0 [pid 347] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 343] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 343] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 347] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 343] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 347] <... mprotect resumed>) = 0 [pid 343] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 347] rt_sigprocmask(SIG_BLOCK, ~[], [pid 343] rt_sigprocmask(SIG_BLOCK, ~[], [pid 347] <... rt_sigprocmask resumed>[], 8) = 0 [pid 343] <... rt_sigprocmask resumed>[], 8) = 0 [pid 343] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 347] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[357]}, 88) = 357 [pid 347] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 343] <... clone3 resumed> => {parent_tid=[356]}, 88) = 356 [pid 347] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] rt_sigprocmask(SIG_SETMASK, [], [pid 347] <... futex resumed>) = 0 [pid 343] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 347] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 347] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 343] <... futex resumed>) = 0 [pid 347] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 343] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 343] <... futex resumed>) = 0 [pid 347] <... mprotect resumed>) = 0 [pid 343] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 347] rt_sigprocmask(SIG_BLOCK, ~[], [pid 343] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 347] <... rt_sigprocmask resumed>[], 8) = 0 [pid 343] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 347] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 343] <... mprotect resumed>) = 0 [pid 343] rt_sigprocmask(SIG_BLOCK, ~[], [pid 347] <... clone3 resumed> => {parent_tid=[358]}, 88) = 358 [pid 343] <... rt_sigprocmask resumed>[], 8) = 0 [pid 347] rt_sigprocmask(SIG_SETMASK, [], [pid 343] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 347] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 351] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 350] set_robust_list(0x7f0c4a20e9a0, 24./strace-static-x86_64: Process 352 attached ./strace-static-x86_64: Process 353 attached ./strace-static-x86_64: Process 355 attached [pid 351] <... set_robust_list resumed>) = 0 [pid 350] <... set_robust_list resumed>) = 0 [pid 347] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] <... clone3 resumed> => {parent_tid=[359]}, 88) = 359 ./strace-static-x86_64: Process 359 attached ./strace-static-x86_64: Process 358 attached ./strace-static-x86_64: Process 357 attached ./strace-static-x86_64: Process 356 attached [pid 352] set_robust_list(0x7f0c4a20e9a0, 24 [pid 351] rt_sigprocmask(SIG_SETMASK, [], [pid 350] rt_sigprocmask(SIG_SETMASK, [], [pid 352] <... set_robust_list resumed>) = 0 [pid 351] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 350] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 347] <... futex resumed>) = 0 [pid 343] rt_sigprocmask(SIG_SETMASK, [], [pid 352] rt_sigprocmask(SIG_SETMASK, [], [pid 351] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 350] memfd_create("syzkaller", 0 [pid 347] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 343] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 353] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 352] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 351] <... open resumed>) = 3 [pid 350] <... memfd_create resumed>) = 4 [pid 343] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] <... set_robust_list resumed>) = 0 [pid 352] memfd_create("syzkaller", 0 [pid 351] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 343] <... futex resumed>) = 0 [pid 352] <... memfd_create resumed>) = 3 [pid 343] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 350] <... mmap resumed>) = 0x7f0c41dcd000 [pid 358] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 357] set_robust_list(0x7f0c4a20e9a0, 24 [pid 356] set_robust_list(0x7f0c4a20e9a0, 24 [pid 355] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 353] rt_sigprocmask(SIG_SETMASK, [], [pid 352] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 351] <... futex resumed>) = 1 [pid 346] <... futex resumed>) = 0 [pid 341] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 350] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 352] <... mmap resumed>) = 0x7f0c41dcd000 [pid 346] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 357] <... set_robust_list resumed>) = 0 [pid 356] <... set_robust_list resumed>) = 0 [pid 355] <... set_robust_list resumed>) = 0 [pid 353] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 351] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 341] ioctl(6, LOOP_CLR_FD [pid 350] <... write resumed>) = 262144 [pid 346] <... futex resumed>) = 0 [pid 352] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 346] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 358] <... set_robust_list resumed>) = 0 [pid 357] rt_sigprocmask(SIG_SETMASK, [], [pid 356] rt_sigprocmask(SIG_SETMASK, [], [pid 355] rt_sigprocmask(SIG_SETMASK, [], [pid 353] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 351] <... mount resumed>) = 0 [pid 350] munmap(0x7f0c41dcd000, 138412032 [pid 341] <... ioctl resumed>) = 0 [pid 353] <... open resumed>) = 4 [pid 351] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] close(6 [pid 352] <... write resumed>) = 262144 [pid 351] <... futex resumed>) = 1 [pid 353] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 346] <... futex resumed>) = 0 [pid 341] <... close resumed>) = 0 [pid 358] rt_sigprocmask(SIG_SETMASK, [], [pid 357] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 356] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 355] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 353] <... futex resumed>) = 1 [pid 352] munmap(0x7f0c41dcd000, 138412032 [pid 351] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 350] <... munmap resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 346] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 341] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] memfd_create("syzkaller", 0 [pid 353] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 351] <... open resumed>) = 5 [pid 348] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 346] <... futex resumed>) = 0 [pid 341] <... futex resumed>) = 0 [pid 340] exit_group(0 [pid 359] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 358] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 357] memfd_create("syzkaller", 0 [pid 356] <... memfd_create resumed>) = 3 [pid 355] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 353] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 352] <... munmap resumed>) = 0 [pid 351] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 348] <... futex resumed>) = 0 [pid 346] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 340] <... exit_group resumed>) = ? [pid 342] <... futex resumed>) = -1 (errno 18446744073709551414) [pid 359] <... set_robust_list resumed>) = 0 [pid 358] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 357] <... memfd_create resumed>) = 3 [pid 356] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 355] <... open resumed>) = 3 [pid 353] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 352] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 351] <... futex resumed>) = 0 [pid 350] <... openat resumed>) = 6 [pid 348] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 346] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 353] <... mount resumed>) = 0 [pid 351] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 342] +++ exited with 0 +++ [pid 359] rt_sigprocmask(SIG_SETMASK, [], [pid 358] <... open resumed>) = 4 [pid 357] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 356] <... mmap resumed>) = 0x7f0c41dcd000 [pid 355] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 352] <... openat resumed>) = 5 [pid 350] ioctl(6, LOOP_SET_FD, 4 [pid 346] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 357] <... mmap resumed>) = 0x7f0c41dcd000 [pid 355] <... futex resumed>) = 1 [pid 353] <... futex resumed>) = 1 [pid 352] ioctl(5, LOOP_SET_FD, 3 [pid 349] <... futex resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 357] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 356] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 355] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 353] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 352] <... ioctl resumed>) = 0 [pid 351] <... futex resumed>) = 0 [pid 350] <... ioctl resumed>) = 0 [pid 349] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 348] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 346] <... futex resumed>) = 1 [pid 357] <... write resumed>) = 262144 [pid 356] <... write resumed>) = 262144 [pid 355] <... mount resumed>) = 0 [pid 353] <... open resumed>) = 6 [pid 352] close(3 [pid 351] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 349] <... futex resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 346] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] munmap(0x7f0c41dcd000, 138412032 [pid 356] munmap(0x7f0c41dcd000, 138412032 [pid 355] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 352] <... close resumed>) = 0 [pid 349] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 357] <... munmap resumed>) = 0 [pid 356] <... munmap resumed>) = 0 [pid 355] <... futex resumed>) = 0 [pid 353] <... futex resumed>) = 0 [pid 352] mkdir("./bus", 0777 [pid 349] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 348] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 357] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 356] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 355] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 353] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 352] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 349] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 348] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 357] <... openat resumed>) = 5 [pid 356] <... openat resumed>) = 4 [pid 355] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 353] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 352] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 349] <... futex resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 357] ioctl(5, LOOP_SET_FD, 3 [ 22.728650][ T341] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/1/bus supports timestamps until 2038 (0x7fffffff) [ 22.755481][ T350] loop2: detected capacity change from 0 to 512 [ 22.757826][ T354] EXT4-fs (loop3): 1 orphan inode deleted [ 22.761902][ T352] loop4: detected capacity change from 0 to 512 [ 22.769639][ T356] loop1: detected capacity change from 0 to 512 [pid 356] ioctl(4, LOOP_SET_FD, 3 [pid 355] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 353] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 349] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 359] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 358] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 357] <... ioctl resumed>) = 0 [pid 355] <... open resumed>) = 5 [pid 351] <... write resumed>) = 8 [pid 355] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] close(4 [pid 355] <... futex resumed>) = 1 [pid 350] <... close resumed>) = 0 [pid 349] <... futex resumed>) = 0 [pid 355] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 350] mkdir("./bus", 0777 [pid 349] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 355] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 350] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 349] <... futex resumed>) = 0 [pid 355] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 350] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 349] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 359] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 358] <... futex resumed>) = 1 [pid 355] <... write resumed>) = 8 [pid 351] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 343] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 353] <... write resumed>) = 8 [pid 359] <... open resumed>) = 5 [pid 358] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 357] close(3 [pid 356] <... ioctl resumed>) = 0 [pid 355] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 351] <... futex resumed>) = 1 [pid 347] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 346] <... futex resumed>) = 0 [pid 343] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 358] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 355] <... futex resumed>) = 1 [pid 353] <... futex resumed>) = 1 [pid 351] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 349] <... futex resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 347] <... futex resumed>) = 0 [pid 346] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] <... futex resumed>) = 0 [pid 359] <... futex resumed>) = 0 [pid 358] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 355] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 353] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 351] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 349] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 348] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 346] <... futex resumed>) = 0 [pid 343] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 359] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 358] <... mount resumed>) = 0 [pid 355] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 353] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 351] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 349] <... futex resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 346] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 343] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 358] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 355] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 353] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 351] <... write resumed>) = 1045 [pid 349] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 348] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 343] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 358] <... futex resumed>) = 1 [pid 355] <... write resumed>) = 1045 [pid 353] <... write resumed>) = 1045 [pid 351] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 347] <... futex resumed>) = 0 [pid 343] <... mprotect resumed>) = 0 [pid 358] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 355] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 353] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 351] <... futex resumed>) = 1 [pid 347] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 346] <... futex resumed>) = 0 [pid 343] rt_sigprocmask(SIG_BLOCK, ~[], [pid 358] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 355] <... futex resumed>) = 1 [pid 353] <... futex resumed>) = 1 [pid 351] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 349] <... futex resumed>) = 0 [pid 348] <... futex resumed>) = 0 [pid 347] <... futex resumed>) = 0 [pid 343] <... rt_sigprocmask resumed>[], 8) = 0 [pid 358] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 355] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 353] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 347] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 343] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 357] <... close resumed>) = 0 [pid 356] close(3 [pid 358] <... open resumed>) = 3 [pid 357] mkdir("./bus", 0777 [pid 356] <... close resumed>) = 0 [pid 354] <... mount resumed>) = 0 [pid 341] +++ exited with 0 +++ [pid 340] +++ exited with 0 +++ [pid 357] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 356] mkdir("./bus", 0777 [pid 354] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 357] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 356] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 354] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 356] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 354] ioctl(4, LOOP_CLR_FD) = 0 [pid 354] close(4) = 0 [pid 354] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 354] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 349] exit_group(0 [pid 354] <... futex resumed>) = ? [pid 349] <... exit_group resumed>) = ? [pid 354] +++ exited with 0 +++ [pid 343] <... clone3 resumed> => {parent_tid=[367]}, 88) = 367 [pid 343] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 343] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 343] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 367 attached [pid 367] set_robust_list(0x7f0c4a1cc9a0, 24) = 0 [pid 367] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 367] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=340, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 299] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 358] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... openat resumed>) = 3 [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, [pid 358] <... futex resumed>) = 1 [pid 355] <... futex resumed>) = ? [pid 347] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 358] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 347] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 355] +++ exited with 0 +++ [pid 349] +++ exited with 0 +++ [pid 347] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 358] <... write resumed>) = 8 [pid 347] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 358] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=349, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 358] <... futex resumed>) = 1 [pid 347] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./1/bus", [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 358] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 347] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... restart_syscall resumed>) = 0 [pid 358] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 347] <... futex resumed>) = 0 [pid 299] unlink("./1/bus") = 0 [pid 299] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./1/binderfs") = 0 [pid 299] getdents64(3, [pid 358] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 347] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3 [pid 358] <... write resumed>) = 1045 [pid 299] <... close resumed>) = 0 [pid 299] rmdir("./1") = 0 [pid 299] mkdir("./2", 0777 [pid 358] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... mkdir resumed>) = 0 [pid 297] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 358] <... futex resumed>) = 1 [pid 347] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 358] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... openat resumed>) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3 [pid 297] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] <... close resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... openat resumed>) = 3 [pid 297] newfstatat(3, "", [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 371 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 297] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 297] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./1/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./1/bus") = 0 [ 22.780012][ T357] loop0: detected capacity change from 0 to 512 [ 22.785051][ T354] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 22.799682][ T354] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/1/file1 supports timestamps until 2038 (0x7fffffff) [ 22.818434][ T352] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 297] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 367] <... mount resumed>) = 0 [pid 367] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] <... futex resumed>) = 0 [pid 343] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] <... futex resumed>) = 0 [pid 343] <... futex resumed>) = 1 [pid 359] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 3 [pid 343] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 359] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 359] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 343] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 343] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 359] <... futex resumed>) = 0 [pid 343] <... futex resumed>) = 1 [pid 359] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 343] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 359] <... write resumed>) = 8 [pid 297] unlink("./1/binderfs" [pid 359] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 343] <... futex resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 359] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 343] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 359] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 343] <... futex resumed>) = 0 [pid 359] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 343] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 359] <... write resumed>) = 1045 [pid 367] <... futex resumed>) = 1 [pid 359] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 367] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 359] <... futex resumed>) = 1 [pid 343] <... futex resumed>) = 0 [pid 359] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 371 attached [pid 371] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 371] chdir("./2") = 0 [pid 371] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 371] setpgid(0, 0) = 0 [pid 371] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 371] write(3, "1000", 4) = 4 [pid 371] close(3) = 0 [pid 371] symlink("/dev/binderfs", "./binderfs" [pid 350] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 350] ioctl(6, LOOP_CLR_FD) = 0 [pid 371] <... symlink resumed>) = 0 [pid 350] close(6) = 0 [pid 371] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 350] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 350] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] <... futex resumed>) = 0 [pid 371] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 371] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 371] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 371] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 346] exit_group(0 [pid 351] <... futex resumed>) = ? [pid 346] <... exit_group resumed>) = ? [pid 351] +++ exited with 0 +++ [pid 350] <... futex resumed>) = ? [pid 371] <... mprotect resumed>) = 0 [pid 371] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 371] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[374]}, 88) = 374 [ 22.852194][ T352] EXT4-fs (loop4): get root inode failed [ 22.869288][ T350] EXT4-fs error (device loop2): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 22.884194][ T350] EXT4-fs (loop2): get root inode failed [ 22.887560][ T352] EXT4-fs (loop4): mount failed [ 22.889961][ T350] EXT4-fs (loop2): mount failed [pid 371] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 374 attached NULL, 8) = 0 [pid 374] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 374] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 374] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 374] <... futex resumed>) = 0 [pid 374] memfd_create("syzkaller", 0) = 3 [pid 374] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dee000 [pid 374] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 374] munmap(0x7f0c41dee000, 138412032) = 0 [pid 374] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 374] ioctl(4, LOOP_SET_FD, 3 [pid 371] <... futex resumed>) = 1 [pid 297] <... umount2 resumed>) = 0 [pid 371] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 352] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 371] <... futex resumed>) = 0 [pid 371] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 371] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 371] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 371] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[375]}, 88) = 375 [pid 371] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 371] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 371] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 374] <... ioctl resumed>) = 0 [pid 374] close(3) = 0 [pid 374] mkdir("./file1", 0777 [pid 297] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./1/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./1/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./1/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 350] +++ exited with 0 +++ [pid 346] +++ exited with 0 +++ [pid 297] <... openat resumed>) = 4 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=346, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 297] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] getdents64(4, [pid 352] ioctl(5, LOOP_CLR_FD [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 352] <... ioctl resumed>) = 0 [pid 297] getdents64(4, [pid 296] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] <... openat resumed>) = 3 [pid 297] close(4 [pid 296] newfstatat(3, "", [pid 297] <... close resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] rmdir("./1/file1" [pid 296] getdents64(3, [pid 297] <... rmdir resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 296] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] getdents64(3, [pid 296] <... umount2 resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] close(3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... close resumed>) = 0 [pid 297] rmdir("./1" [pid 296] newfstatat(AT_FDCWD, "./1/bus", [pid 352] close(5) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 352] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] mkdir("./2", 0777 [pid 296] unlink("./1/bus" [pid 348] exit_group(0 [pid 353] <... futex resumed>) = ? [pid 352] <... futex resumed>) = ? [pid 348] <... exit_group resumed>) = ? [pid 297] <... mkdir resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 353] +++ exited with 0 +++ [pid 296] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 352] +++ exited with 0 +++ [pid 348] +++ exited with 0 +++ [pid 297] <... openat resumed>) = 3 [pid 296] newfstatat(AT_FDCWD, "./1/binderfs", [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=348, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 297] ioctl(3, LOOP_CLR_FD [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] unlink("./1/binderfs" [pid 374] <... mkdir resumed>) = 0 [pid 298] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] close(3 [pid 296] <... unlink resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [ 22.908298][ T357] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 22.921404][ T356] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 22.929101][ T374] loop5: detected capacity change from 0 to 512 [ 22.940785][ T357] EXT4-fs (loop0): get root inode failed [pid 374] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 297] <... close resumed>) = 0 [pid 298] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] getdents64(3, [pid 298] <... openat resumed>) = 3 [pid 298] newfstatat(3, "", [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 376 [pid 296] close(3 [pid 298] getdents64(3, [pid 296] <... close resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 296] rmdir("./1" [pid 298] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... rmdir resumed>) = 0 [pid 296] mkdir("./2", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 377 [pid 298] <... umount2 resumed>) = 0 [pid 298] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./1/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./1/bus") = 0 [pid 298] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./1/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./1/binderfs") = 0 [pid 298] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./1") = 0 [pid 298] mkdir("./2", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 357] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) ./strace-static-x86_64: Process 375 attached ./strace-static-x86_64: Process 377 attached ./strace-static-x86_64: Process 376 attached [pid 375] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 357] ioctl(5, LOOP_CLR_FD [pid 356] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 377] set_robust_list(0x555556d8d6a0, 24 [pid 376] set_robust_list(0x555556d8d6a0, 24 [pid 375] <... set_robust_list resumed>) = 0 [pid 357] <... ioctl resumed>) = 0 [pid 377] <... set_robust_list resumed>) = 0 [pid 376] <... set_robust_list resumed>) = 0 [pid 375] rt_sigprocmask(SIG_SETMASK, [], [pid 371] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 357] close(5 [pid 356] ioctl(4, LOOP_CLR_FD [pid 377] chdir("./2" [pid 376] chdir("./2" [pid 375] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 371] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 357] <... close resumed>) = 0 [pid 375] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 371] <... futex resumed>) = 0 [pid 357] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 356] <... ioctl resumed>) = 0 [pid 375] <... open resumed>) = 3 [pid 371] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 357] <... futex resumed>) = 0 [pid 375] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] <... mmap resumed>) = 0x7f0c4a1ac000 [pid 357] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 356] close(4 [pid 347] exit_group(0 [pid 375] <... futex resumed>) = 0 [pid 371] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE [pid 358] <... futex resumed>) = ? [pid 357] <... futex resumed>) = ? [pid 356] <... close resumed>) = 0 [pid 347] <... exit_group resumed>) = ? [pid 375] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] <... mprotect resumed>) = 0 [pid 358] +++ exited with 0 +++ [pid 357] +++ exited with 0 +++ [pid 356] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 371] rt_sigprocmask(SIG_BLOCK, ~[], [pid 356] <... futex resumed>) = 0 [pid 347] +++ exited with 0 +++ [pid 343] exit_group(0 [pid 371] <... rt_sigprocmask resumed>[], 8) = 0 [pid 367] <... futex resumed>) = ? [pid 359] <... futex resumed>) = ? [pid 343] <... exit_group resumed>) = ? [pid 371] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} [pid 367] +++ exited with 0 +++ [pid 359] +++ exited with 0 +++ [pid 356] +++ exited with 0 +++ [pid 371] <... clone3 resumed> => {parent_tid=[379]}, 88) = 379 [pid 376] <... chdir resumed>) = 0 [pid 371] rt_sigprocmask(SIG_SETMASK, [], [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=347, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 376] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 371] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... openat resumed>) = 3 [pid 371] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] ioctl(3, LOOP_CLR_FD [pid 294] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 377] <... chdir resumed>) = 0 [pid 376] <... prctl resumed>) = 0 [pid 371] <... futex resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 377] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 376] setpgid(0, 0 [pid 371] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] close(3 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 377] <... prctl resumed>) = 0 [pid 376] <... setpgid resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 294] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 376] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 377] setpgid(0, 0 [pid 294] <... openat resumed>) = 3 ./strace-static-x86_64: Process 379 attached [pid 294] newfstatat(3, "", [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 380 [pid 376] <... openat resumed>) = 3 [pid 377] <... setpgid resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 376] write(3, "1000", 4 [pid 377] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 294] getdents64(3, [pid 376] <... write resumed>) = 4 [pid 376] close(3 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 377] <... openat resumed>) = 3 [pid 376] <... close resumed>) = 0 [pid 294] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 377] write(3, "1000", 4 [pid 376] symlink("/dev/binderfs", "./binderfs" [pid 379] set_robust_list(0x7f0c4a1cc9a0, 24 [pid 377] <... write resumed>) = 4 [pid 294] <... umount2 resumed>) = 0 [pid 376] <... symlink resumed>) = 0 [pid 377] close(3 [pid 294] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 377] <... close resumed>) = 0 [pid 376] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 377] symlink("/dev/binderfs", "./binderfs" [pid 376] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 294] newfstatat(AT_FDCWD, "./1/bus", [pid 376] <... rt_sigaction resumed>NULL, 8) = 0 [pid 379] <... set_robust_list resumed>) = 0 [pid 377] <... symlink resumed>) = 0 [pid 376] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 379] rt_sigprocmask(SIG_SETMASK, [], [pid 377] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] unlink("./1/bus" [pid 379] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 377] <... futex resumed>) = 0 [pid 376] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 294] <... unlink resumed>) = 0 [ 22.969606][ T356] EXT4-fs (loop1): get root inode failed [ 22.978609][ T357] EXT4-fs (loop0): mount failed [ 22.987850][ T356] EXT4-fs (loop1): mount failed [pid 377] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 376] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 294] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 377] <... rt_sigaction resumed>NULL, 8) = 0 [pid 376] <... mprotect resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 380 attached [pid 379] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 294] newfstatat(AT_FDCWD, "./1/binderfs", [pid 376] rt_sigprocmask(SIG_BLOCK, ~[], [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 380] set_robust_list(0x555556d8d6a0, 24 [pid 379] <... mount resumed>) = 0 [pid 294] unlink("./1/binderfs" [pid 380] <... set_robust_list resumed>) = 0 [pid 379] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] chdir("./2" [pid 379] <... futex resumed>) = 1 [pid 371] <... futex resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 380] <... chdir resumed>) = 0 [pid 379] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] getdents64(3, [pid 380] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 375] <... futex resumed>) = 0 [pid 371] <... futex resumed>) = 1 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 380] <... prctl resumed>) = 0 [pid 375] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 371] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] close(3 [pid 380] setpgid(0, 0 [pid 376] <... rt_sigprocmask resumed>[], 8) = 0 [pid 375] <... open resumed>) = 5 [pid 294] <... close resumed>) = 0 [pid 380] <... setpgid resumed>) = 0 [pid 375] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 376] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 375] <... futex resumed>) = 1 [pid 371] <... futex resumed>) = 0 [pid 294] rmdir("./1" [pid 380] <... openat resumed>) = 3 [pid 375] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] write(3, "1000", 4 [pid 375] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 371] <... futex resumed>) = 0 [pid 380] <... write resumed>) = 4 [pid 375] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 371] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 380] close(3 [pid 376] <... clone3 resumed> => {parent_tid=[382]}, 88) = 382 [pid 294] <... rmdir resumed>) = 0 [pid 375] <... write resumed>) = 8 [pid 375] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] rt_sigprocmask(SIG_SETMASK, [], [pid 375] <... futex resumed>) = 1 [pid 371] <... futex resumed>) = 0 [pid 294] mkdir("./2", 0777 [pid 380] <... close resumed>) = 0 [pid 380] symlink("/dev/binderfs", "./binderfs") = 0 [pid 380] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 380] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 380] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 380] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 380] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 380] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[383]}, 88) = 383 [pid 380] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 380] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 380] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 380] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 380] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[384]}, 88) = 384 [pid 380] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 380] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 380] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 377] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 377] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 377] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 377] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 377] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[385]}, 88) = 385 [pid 377] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 375] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 371] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 385 attached ./strace-static-x86_64: Process 382 attached [pid 377] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 375] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 371] <... futex resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 377] <... futex resumed>) = 0 [pid 377] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 377] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 377] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 377] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 377] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[386]}, 88) = 386 [pid 377] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 377] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 377] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 383 attached [pid 383] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 383] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 383] memfd_create("syzkaller", 0) = 3 [pid 383] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 383] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 383] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 383] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 4 [pid 383] ioctl(4, LOOP_SET_FD, 3 [pid 376] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 375] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 371] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 376] <... futex resumed>) = 0 [pid 376] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 384 attached ./strace-static-x86_64: Process 386 attached [pid 385] set_robust_list(0x7f0c4a20e9a0, 24 [pid 382] set_robust_list(0x7f0c4a20e9a0, 24 [pid 376] <... futex resumed>) = 0 [pid 375] <... write resumed>) = 1045 [pid 386] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 385] <... set_robust_list resumed>) = 0 [pid 384] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 382] <... set_robust_list resumed>) = 0 [pid 376] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 375] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 343] +++ exited with 0 +++ [pid 294] <... openat resumed>) = 3 [pid 383] <... ioctl resumed>) = 0 [pid 383] close(3) = 0 [pid 383] mkdir("./file1", 0777 [pid 386] <... set_robust_list resumed>) = 0 [pid 385] rt_sigprocmask(SIG_SETMASK, [], [pid 384] <... set_robust_list resumed>) = 0 [pid 382] rt_sigprocmask(SIG_SETMASK, [], [pid 376] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 375] <... futex resumed>) = 1 [pid 371] <... futex resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=343, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 294] ioctl(3, LOOP_CLR_FD [pid 383] <... mkdir resumed>) = 0 [pid 386] rt_sigprocmask(SIG_SETMASK, [], [pid 384] rt_sigprocmask(SIG_SETMASK, [], [pid 382] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 375] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 386] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 385] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 384] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 382] memfd_create("syzkaller", 0 [pid 376] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 386] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 384] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 294] close(3 [pid 385] memfd_create("syzkaller", 0 [pid 376] <... mprotect resumed>) = 0 [pid 384] <... open resumed>) = 3 [pid 294] <... close resumed>) = 0 [pid 386] <... open resumed>) = 3 [pid 383] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 376] rt_sigprocmask(SIG_BLOCK, ~[], [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 386] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 385] <... memfd_create resumed>) = 4 [pid 384] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 382] <... memfd_create resumed>) = 3 [pid 295] umount2("./1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 377] <... futex resumed>) = 0 [pid 386] <... futex resumed>) = 1 [pid 385] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 384] <... futex resumed>) = 1 [pid 382] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 380] <... futex resumed>) = 0 [pid 376] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 386] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 385] <... mmap resumed>) = 0x7f0c41dcd000 [pid 384] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 382] <... mmap resumed>) = 0x7f0c41dcd000 [pid 380] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 295] openat(AT_FDCWD, "./1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 387 [pid 386] <... mount resumed>) = -1 ENOENT (No such file or directory) ./strace-static-x86_64: Process 387 attached [pid 387] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 387] chdir("./2" [pid 385] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 380] <... futex resumed>) = 0 [pid 377] <... futex resumed>) = 0 [pid 377] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 380] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... openat resumed>) = 3 [pid 387] <... chdir resumed>) = 0 [pid 387] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 387] setpgid(0, 0) = 0 [pid 382] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 376] <... clone3 resumed> => {parent_tid=[388]}, 88) = 388 [pid 384] <... mount resumed>) = 0 [pid 386] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] newfstatat(3, "", [pid 386] <... futex resumed>) = 1 [pid 384] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] <... futex resumed>) = 0 [pid 376] rt_sigprocmask(SIG_SETMASK, [], [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 386] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 384] <... futex resumed>) = 1 [pid 380] <... futex resumed>) = 0 [pid 377] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] getdents64(3, [pid 387] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 387] write(3, "1000", 4 [pid 380] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] <... futex resumed>) = 0 [pid 386] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 384] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 380] <... futex resumed>) = 0 [pid 377] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 376] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 387] <... write resumed>) = 4 [pid 387] close(3 [pid 385] <... write resumed>) = 262144 [pid 386] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 384] <... open resumed>) = 5 [pid 380] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 376] <... futex resumed>) = 0 [pid 295] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 386] <... futex resumed>) = 1 [pid 384] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 377] <... futex resumed>) = 0 [pid 376] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... umount2 resumed>) = 0 [pid 386] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 384] <... futex resumed>) = 0 [pid 380] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 388 attached [pid 386] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 385] munmap(0x7f0c41dcd000, 138412032 [pid 384] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 382] <... write resumed>) = 262144 [pid 380] <... futex resumed>) = 0 [pid 377] <... futex resumed>) = 0 [pid 374] <... mount resumed>) = 0 [pid 295] umount2("./1/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 387] <... close resumed>) = 0 [pid 387] symlink("/dev/binderfs", "./binderfs") = 0 [pid 387] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 387] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 387] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 387] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 387] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 387] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[389]}, 88) = 389 [pid 387] rt_sigprocmask(SIG_SETMASK, [], [pid 388] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 386] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 385] <... munmap resumed>) = 0 [pid 382] munmap(0x7f0c41dcd000, 138412032 [pid 380] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 377] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 386] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 386] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 387] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 382] <... munmap resumed>) = 0 [pid 388] <... set_robust_list resumed>) = 0 [pid 388] rt_sigprocmask(SIG_SETMASK, [], [pid 386] <... futex resumed>) = 0 [pid 377] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] newfstatat(AT_FDCWD, "./1/bus", [pid 388] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 386] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 377] <... futex resumed>) = 0 [pid 388] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 385] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 384] <... write resumed>) = 8 [pid 382] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 386] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 377] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 388] <... open resumed>) = 4 [pid 386] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 377] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] unlink("./1/bus" [pid 388] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 386] <... futex resumed>) = 0 [pid 385] <... openat resumed>) = 5 [pid 384] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 382] <... openat resumed>) = 5 [pid 386] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 385] ioctl(5, LOOP_SET_FD, 4 [pid 384] <... futex resumed>) = 1 [pid 380] <... futex resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 388] <... futex resumed>) = 1 [pid 382] ioctl(5, LOOP_SET_FD, 3 [pid 376] <... futex resumed>) = 0 [pid 387] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 23.023599][ T374] EXT4-fs (loop5): 1 orphan inode deleted [ 23.029747][ T374] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.041642][ T374] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/2/file1 supports timestamps until 2038 (0x7fffffff) [ 23.042096][ T383] loop4: detected capacity change from 0 to 512 [pid 387] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 387] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 387] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 387] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[391]}, 88) = 391 [pid 387] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 387] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 389 attached [pid 389] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 389] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 389] memfd_create("syzkaller", 0) = 3 [pid 389] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 384] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 380] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] umount2("./1/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 389] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 389] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 389] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4 [pid 389] ioctl(4, LOOP_SET_FD, 3 [pid 388] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 385] <... ioctl resumed>) = 0 [pid 384] <... write resumed>) = 1045 [pid 382] <... ioctl resumed>) = 0 [pid 380] <... futex resumed>) = 0 [pid 376] <... futex resumed>) = 0 [pid 374] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 388] <... mount resumed>) = 0 [pid 384] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 380] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 384] <... futex resumed>) = 0 [pid 380] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 376] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] newfstatat(AT_FDCWD, "./1/binderfs", [pid 388] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 384] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 376] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 388] <... futex resumed>) = 0 [pid 376] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] unlink("./1/binderfs" [pid 388] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 376] <... futex resumed>) = 0 [pid 388] <... open resumed>) = 6 [pid 376] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... unlink resumed>) = 0 [pid 388] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] getdents64(3, [pid 388] <... futex resumed>) = 0 [pid 376] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 388] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 376] <... futex resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 376] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] close(3) = 0 [pid 388] <... write resumed>) = 8 [pid 295] rmdir("./1" [pid 388] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 389] <... ioctl resumed>) = 0 [pid 388] <... futex resumed>) = 1 [pid 376] <... futex resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 388] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 376] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 388] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 376] <... futex resumed>) = 0 [pid 295] mkdir("./2", 0777 [pid 388] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 376] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 389] close(3 [pid 295] <... mkdir resumed>) = 0 [pid 388] <... write resumed>) = 1045 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 389] <... close resumed>) = 0 [pid 388] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 376] <... futex resumed>) = 0 [pid 388] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 389] mkdir("./file1", 0777 [pid 295] <... openat resumed>) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 393 [pid 389] <... mkdir resumed>) = 0 [pid 389] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 393 attached [pid 393] set_robust_list(0x555556d8d6a0, 24 [pid 374] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 393] <... set_robust_list resumed>) = 0 [pid 393] chdir("./2") = 0 [pid 393] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 374] ioctl(4, LOOP_CLR_FD [pid 385] close(4 [pid 382] close(3 [pid 374] <... ioctl resumed>) = 0 [pid 393] <... prctl resumed>) = 0 [pid 393] setpgid(0, 0) = 0 [pid 393] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 393] write(3, "1000", 4) = 4 [pid 393] close(3) = 0 [pid 374] close(4) = 0 [pid 382] <... close resumed>) = 0 [pid 385] <... close resumed>) = 0 [pid 374] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 382] mkdir("./bus", 0777 [pid 385] mkdir("./file1", 0777 [pid 374] <... futex resumed>) = 0 [pid 371] exit_group(0 [pid 385] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 382] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 393] symlink("/dev/binderfs", "./binderfs" [pid 385] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 382] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 379] <... futex resumed>) = ? [pid 375] <... futex resumed>) = ? [pid 371] <... exit_group resumed>) = ? [pid 393] <... symlink resumed>) = 0 [pid 379] +++ exited with 0 +++ [pid 375] +++ exited with 0 +++ [pid 393] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 374] +++ exited with 0 +++ [pid 371] +++ exited with 0 +++ [pid 393] <... futex resumed>) = 0 [pid 393] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [ 23.083967][ T385] loop2: detected capacity change from 0 to 512 [ 23.090360][ T382] loop3: detected capacity change from 0 to 512 [ 23.095071][ T389] loop0: detected capacity change from 0 to 512 [pid 393] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 393] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 393] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 393] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 393] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[395]}, 88) = 395 [pid 393] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 393] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 393] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 393] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 393] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[396]}, 88) = 396 [pid 393] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=371, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 393] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 299] <... restart_syscall resumed>) = 0 [pid 393] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 391 attached [pid 391] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 299] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 391] rt_sigprocmask(SIG_SETMASK, [], [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 391] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] newfstatat(3, "", [pid 391] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 391] <... open resumed>) = 3 [pid 299] getdents64(3, [pid 391] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 299] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 387] <... futex resumed>) = 0 [pid 387] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 387] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 391] <... futex resumed>) = 1 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 391] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 299] newfstatat(AT_FDCWD, "./2/bus", [pid 391] <... mount resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 391] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] unlink("./2/bus" [pid 387] <... futex resumed>) = 0 [pid 387] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... unlink resumed>) = 0 [pid 391] <... futex resumed>) = 1 [pid 299] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 391] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./2/binderfs" [pid 391] <... open resumed>) = 5 [pid 391] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] <... futex resumed>) = 0 [pid 387] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 391] <... futex resumed>) = 1 [pid 391] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 299] <... unlink resumed>) = 0 [pid 382] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 382] ioctl(5, LOOP_CLR_FD) = 0 [pid 382] close(5) = 0 [pid 391] <... write resumed>) = 8 [pid 391] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 387] <... futex resumed>) = 0 [pid 391] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 387] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 387] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 382] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 382] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 396 attached [pid 396] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 396] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 396] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 396] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 393] <... futex resumed>) = 0 [pid 393] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 396] <... futex resumed>) = 1 [pid 396] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 396] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 391] <... write resumed>) = 1045 [pid 391] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 387] <... futex resumed>) = 0 [pid 391] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 393] <... futex resumed>) = 0 [pid 393] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 393] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 396] <... futex resumed>) = 1 [pid 396] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 396] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 376] exit_group(0 [pid 393] <... futex resumed>) = 0 ./strace-static-x86_64: Process 395 attached [pid 393] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 388] <... futex resumed>) = ? [pid 382] <... futex resumed>) = ? [pid 376] <... exit_group resumed>) = ? [pid 395] set_robust_list(0x7f0c4a20e9a0, 24 [pid 393] <... futex resumed>) = 0 [pid 393] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 395] <... set_robust_list resumed>) = 0 [pid 395] rt_sigprocmask(SIG_SETMASK, [], [pid 388] +++ exited with 0 +++ [pid 382] +++ exited with 0 +++ [pid 376] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=376, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 297] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 297] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [ 23.127297][ T382] EXT4-fs (loop3): Invalid log block size: 2475723007 [ 23.139291][ T383] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 23.163327][ T389] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 297] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 395] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 395] memfd_create("syzkaller", 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./2/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./2/bus") = 0 [pid 297] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./2/binderfs") = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./2") = 0 [pid 297] mkdir("./3", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = 0 [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 400 [pid 396] <... futex resumed>) = 1 [pid 395] <... memfd_create resumed>) = 5 ./strace-static-x86_64: Process 400 attached [pid 396] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 395] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 400] set_robust_list(0x555556d8d6a0, 24 [pid 396] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 395] <... mmap resumed>) = 0x7f0c41dcd000 [pid 400] <... set_robust_list resumed>) = 0 [pid 396] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 395] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 400] chdir("./3" [pid 396] <... futex resumed>) = 1 [pid 395] <... write resumed>) = 262144 [pid 393] <... futex resumed>) = 0 [pid 400] <... chdir resumed>) = 0 [pid 396] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 395] munmap(0x7f0c41dcd000, 138412032 [pid 393] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 389] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 383] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 400] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 396] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 395] <... munmap resumed>) = 0 [pid 393] <... futex resumed>) = 0 [pid 389] ioctl(4, LOOP_CLR_FD [pid 400] <... prctl resumed>) = 0 [pid 396] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 395] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 393] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 389] <... ioctl resumed>) = 0 [pid 383] ioctl(4, LOOP_CLR_FD [pid 400] setpgid(0, 0 [pid 396] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 395] <... openat resumed>) = 6 [pid 389] close(4 [pid 383] <... ioctl resumed>) = 0 [pid 400] <... setpgid resumed>) = 0 [pid 396] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 395] ioctl(6, LOOP_SET_FD, 5 [pid 389] <... close resumed>) = 0 [pid 383] close(4 [pid 400] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 396] <... futex resumed>) = 1 [pid 395] <... ioctl resumed>) = 0 [pid 393] <... futex resumed>) = 0 [pid 383] <... close resumed>) = 0 [pid 383] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 383] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 380] exit_group(0 [pid 384] <... futex resumed>) = ? [ 23.176779][ T383] EXT4-fs (loop4): get root inode failed [ 23.182801][ T383] EXT4-fs (loop4): mount failed [ 23.188412][ T389] EXT4-fs (loop0): get root inode failed [ 23.194173][ T389] EXT4-fs (loop0): mount failed [ 23.196008][ T385] EXT4-fs (loop2): 1 orphan inode deleted [ 23.213161][ T395] loop1: detected capacity change from 0 to 512 [pid 383] <... futex resumed>) = ? [pid 380] <... exit_group resumed>) = ? [pid 384] +++ exited with 0 +++ [pid 383] +++ exited with 0 +++ [pid 380] +++ exited with 0 +++ [pid 400] <... openat resumed>) = 3 [pid 396] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 389] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 387] exit_group(0 [pid 400] write(3, "1000", 4 [pid 395] close(5 [pid 391] <... futex resumed>) = ? [pid 389] <... futex resumed>) = ? [pid 387] <... exit_group resumed>) = ? [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=380, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 298] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 298] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 298] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 400] <... write resumed>) = 4 [pid 395] <... close resumed>) = 0 [pid 389] +++ exited with 0 +++ [pid 400] close(3 [pid 395] mkdir("./file1", 0777 [pid 400] <... close resumed>) = 0 [pid 395] <... mkdir resumed>) = 0 [pid 400] symlink("/dev/binderfs", "./binderfs" [pid 395] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 400] <... symlink resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 400] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 400] <... futex resumed>) = 0 [pid 400] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 400] <... rt_sigaction resumed>NULL, 8) = 0 [pid 298] newfstatat(AT_FDCWD, "./2/bus", [pid 400] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 391] +++ exited with 0 +++ [pid 387] +++ exited with 0 +++ [pid 299] <... umount2 resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 400] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] unlink("./2/bus" [pid 400] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 400] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 299] newfstatat(AT_FDCWD, "./2/file1", [pid 298] <... unlink resumed>) = 0 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=387, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 400] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 400] <... mprotect resumed>) = 0 [pid 299] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 400] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 400] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] newfstatat(AT_FDCWD, "./2/binderfs", [pid 294] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 400] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 299] <... openat resumed>) = 4 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] newfstatat(4, "", [pid 298] unlink("./2/binderfs" [pid 294] <... openat resumed>) = 3 [pid 400] <... clone3 resumed> => {parent_tid=[403]}, 88) = 403 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 400] rt_sigprocmask(SIG_SETMASK, [], [pid 299] getdents64(4, [pid 298] <... unlink resumed>) = 0 [pid 294] newfstatat(3, "", [pid 400] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 298] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 400] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] getdents64(4, [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 400] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 298] newfstatat(AT_FDCWD, "./2/file1", [pid 294] getdents64(3, [pid 400] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] close(4 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 400] <... futex resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 298] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 400] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] rmdir("./2/file1" [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 400] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 299] <... rmdir resumed>) = 0 [pid 400] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 299] getdents64(3, [pid 400] <... mprotect resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 400] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] close(3 [pid 400] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] <... close resumed>) = 0 [pid 400] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 299] rmdir("./2" [ 23.219380][ T385] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.230778][ T385] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/2/file1 supports timestamps until 2038 (0x7fffffff) [pid 298] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... umount2 resumed>) = 0 ./strace-static-x86_64: Process 404 attached ./strace-static-x86_64: Process 403 attached [pid 385] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 299] <... rmdir resumed>) = 0 [pid 404] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 403] set_robust_list(0x7f0c4a20e9a0, 24 [pid 400] <... clone3 resumed> => {parent_tid=[404]}, 88) = 404 [pid 299] mkdir("./3", 0777 [pid 404] <... set_robust_list resumed>) = 0 [pid 403] <... set_robust_list resumed>) = 0 [pid 400] rt_sigprocmask(SIG_SETMASK, [], [pid 299] <... mkdir resumed>) = 0 [pid 404] rt_sigprocmask(SIG_SETMASK, [], [pid 403] rt_sigprocmask(SIG_SETMASK, [], [pid 400] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 404] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 403] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 400] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 385] ioctl(5, LOOP_CLR_FD [pid 299] <... openat resumed>) = 3 [pid 298] <... openat resumed>) = 4 [pid 294] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 404] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 403] memfd_create("syzkaller", 0 [pid 400] <... futex resumed>) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 404] <... open resumed>) = 3 [pid 403] <... memfd_create resumed>) = 4 [pid 400] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 404] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] close(3 [pid 404] <... futex resumed>) = 0 [pid 403] <... mmap resumed>) = 0x7f0c41dcd000 [pid 400] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 404] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 403] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 400] <... futex resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 404] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 403] <... write resumed>) = 262144 [pid 400] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 404] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] munmap(0x7f0c41dcd000, 138412032 [pid 400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 406 [pid 404] <... futex resumed>) = 0 [pid 403] <... munmap resumed>) = 0 [pid 400] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(4, "", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 404] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 403] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 400] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] newfstatat(AT_FDCWD, "./2/bus", [pid 404] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 403] <... openat resumed>) = 5 [pid 400] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] getdents64(4, [pid 404] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] ioctl(5, LOOP_SET_FD, 4 [pid 400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 406 attached [pid 404] <... futex resumed>) = 0 [pid 403] <... ioctl resumed>) = 0 [pid 400] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 404] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 403] close(4 [pid 400] <... futex resumed>) = 0 [pid 404] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 403] <... close resumed>) = 0 [pid 400] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 404] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 403] mkdir("./file1", 0777 [pid 400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 404] <... futex resumed>) = 0 [pid 403] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 400] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 404] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 403] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 400] <... futex resumed>) = 0 [pid 404] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 400] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 404] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 400] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 404] <... futex resumed>) = 0 [pid 404] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] unlink("./2/bus") = 0 [pid 294] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./2/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./2/binderfs") = 0 [pid 294] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./2/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 294] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] getdents64(4, [pid 406] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 298] getdents64(4, [pid 294] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 406] chdir("./3" [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] close(4 [pid 406] <... chdir resumed>) = 0 [pid 395] <... mount resumed>) = 0 [pid 298] close(4 [pid 294] <... close resumed>) = 0 [pid 406] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 395] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 298] <... close resumed>) = 0 [pid 294] rmdir("./2/file1" [pid 406] <... prctl resumed>) = 0 [pid 395] <... openat resumed>) = 5 [pid 298] rmdir("./2/file1" [pid 406] setpgid(0, 0 [pid 395] chdir("./file1" [pid 298] <... rmdir resumed>) = 0 [pid 406] <... setpgid resumed>) = 0 [pid 395] <... chdir resumed>) = 0 [pid 298] getdents64(3, [pid 294] <... rmdir resumed>) = 0 [pid 406] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 395] ioctl(6, LOOP_CLR_FD [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 406] <... openat resumed>) = 3 [pid 395] <... ioctl resumed>) = 0 [pid 298] close(3 [pid 294] getdents64(3, [pid 406] write(3, "1000", 4 [pid 395] close(6 [pid 298] <... close resumed>) = 0 [pid 406] <... write resumed>) = 4 [pid 298] rmdir("./2" [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./2" [pid 406] close(3 [pid 294] <... rmdir resumed>) = 0 [pid 406] <... close resumed>) = 0 [pid 294] mkdir("./3", 0777 [pid 406] symlink("/dev/binderfs", "./binderfs" [pid 298] <... rmdir resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 385] <... ioctl resumed>) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 406] <... symlink resumed>) = 0 [pid 385] close(5 [pid 298] mkdir("./3", 0777 [pid 294] <... openat resumed>) = 3 [pid 406] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 385] <... close resumed>) = 0 [pid 294] ioctl(3, LOOP_CLR_FD [pid 406] <... futex resumed>) = 0 [pid 385] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... mkdir resumed>) = 0 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 408 [pid 395] <... close resumed>) = 0 [pid 395] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 393] exit_group(0 [pid 377] exit_group(0 [pid 406] <... rt_sigaction resumed>NULL, 8) = 0 [pid 393] <... exit_group resumed>) = ? [pid 385] <... futex resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 396] <... futex resumed>) = ? [pid 406] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 386] <... futex resumed>) = ? [pid 396] +++ exited with 0 +++ [pid 395] <... futex resumed>) = ? [pid 385] +++ exited with 0 +++ [pid 377] <... exit_group resumed>) = ? [pid 298] <... openat resumed>) = 3 [pid 406] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 395] +++ exited with 0 +++ [pid 393] +++ exited with 0 +++ [pid 386] +++ exited with 0 +++ [pid 377] +++ exited with 0 +++ [pid 298] ioctl(3, LOOP_CLR_FD [pid 406] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=377, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=393, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 406] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 298] close(3 [pid 406] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 298] <... close resumed>) = 0 [pid 406] <... mprotect resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./2", MNT_DETACH|UMOUNT_NOFOLLOW [pid 406] rt_sigprocmask(SIG_BLOCK, ~[], ./strace-static-x86_64: Process 409 attached ./strace-static-x86_64: Process 408 attached [], 8) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 409] set_robust_list(0x555556d8d6a0, 24 [pid 408] set_robust_list(0x555556d8d6a0, 24 [pid 406] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 409 [pid 296] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] openat(AT_FDCWD, "./2", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 409] <... set_robust_list resumed>) = 0 [pid 408] <... set_robust_list resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 409] chdir("./3" [pid 408] chdir("./3" [pid 406] <... clone3 resumed> => {parent_tid=[411]}, 88) = 411 [pid 296] newfstatat(3, "", [pid 295] newfstatat(3, "", ./strace-static-x86_64: Process 411 attached [pid 409] <... chdir resumed>) = 0 [pid 408] <... chdir resumed>) = 0 [pid 406] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 411] set_robust_list(0x7f0c4a20e9a0, 24 [pid 409] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 408] prctl(PR_SET_PDEATHSIG, SIGKILL [ 23.271392][ T395] EXT4-fs (loop1): 1 orphan inode deleted [ 23.279002][ T395] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.294216][ T403] loop3: detected capacity change from 0 to 512 [ 23.295781][ T395] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/2/file1 supports timestamps until 2038 (0x7fffffff) [pid 406] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] getdents64(3, [pid 409] <... prctl resumed>) = 0 [pid 408] <... prctl resumed>) = 0 [pid 295] getdents64(3, [pid 409] setpgid(0, 0 [pid 408] setpgid(0, 0 [pid 409] <... setpgid resumed>) = 0 [pid 408] <... setpgid resumed>) = 0 [pid 409] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 408] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 409] <... openat resumed>) = 3 [pid 408] <... openat resumed>) = 3 [pid 409] write(3, "1000", 4 [pid 408] write(3, "1000", 4 [pid 406] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 411] <... set_robust_list resumed>) = 0 [pid 409] <... write resumed>) = 4 [pid 408] <... write resumed>) = 4 [pid 406] <... futex resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 295] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 409] close(3 [pid 408] close(3 [pid 409] <... close resumed>) = 0 [pid 408] <... close resumed>) = 0 [pid 406] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = 0 [pid 411] rt_sigprocmask(SIG_SETMASK, [], [pid 409] symlink("/dev/binderfs", "./binderfs" [pid 408] symlink("/dev/binderfs", "./binderfs" [pid 409] <... symlink resumed>) = 0 [pid 408] <... symlink resumed>) = 0 [pid 409] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 409] <... futex resumed>) = 0 [pid 408] <... futex resumed>) = 0 [pid 409] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 408] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 409] <... rt_sigaction resumed>NULL, 8) = 0 [pid 408] <... rt_sigaction resumed>NULL, 8) = 0 [pid 409] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 408] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 411] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 409] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 408] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 406] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./2/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 411] memfd_create("syzkaller", 0 [pid 409] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 408] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 406] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] newfstatat(AT_FDCWD, "./2/binderfs", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 411] <... memfd_create resumed>) = 3 [pid 409] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 408] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 406] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] newfstatat(AT_FDCWD, "./2/bus", [pid 411] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 409] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 408] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 406] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 296] unlink("./2/binderfs" [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 411] <... mmap resumed>) = 0x7f0c41dcd000 [pid 409] <... mprotect resumed>) = 0 [pid 408] <... mprotect resumed>) = 0 [pid 406] <... mprotect resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 295] unlink("./2/bus" [pid 411] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 409] rt_sigprocmask(SIG_BLOCK, ~[], [pid 408] rt_sigprocmask(SIG_BLOCK, ~[], [pid 406] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... unlink resumed>) = 0 [pid 411] <... write resumed>) = 262144 [pid 409] <... rt_sigprocmask resumed>[], 8) = 0 [pid 408] <... rt_sigprocmask resumed>[], 8) = 0 [pid 406] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./2/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 411] munmap(0x7f0c41dcd000, 138412032 [pid 409] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 408] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 406] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 296] newfstatat(AT_FDCWD, "./2/file1", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 414 attached ./strace-static-x86_64: Process 413 attached ./strace-static-x86_64: Process 412 attached [pid 411] <... munmap resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] newfstatat(AT_FDCWD, "./2/binderfs", [pid 411] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 409] <... clone3 resumed> => {parent_tid=[412]}, 88) = 412 [pid 408] <... clone3 resumed> => {parent_tid=[413]}, 88) = 413 [pid 406] <... clone3 resumed> => {parent_tid=[414]}, 88) = 414 [pid 296] unlink("./2/file1" [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 411] <... openat resumed>) = 4 [pid 409] rt_sigprocmask(SIG_SETMASK, [], [pid 408] rt_sigprocmask(SIG_SETMASK, [], [pid 406] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... unlink resumed>) = 0 [pid 295] unlink("./2/binderfs" [pid 414] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 413] set_robust_list(0x7f0c4a20e9a0, 24 [pid 412] set_robust_list(0x7f0c4a20e9a0, 24 [pid 411] ioctl(4, LOOP_SET_FD, 3 [pid 409] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 408] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 406] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 403] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 296] getdents64(3, [pid 295] <... unlink resumed>) = 0 [pid 414] <... set_robust_list resumed>) = 0 [pid 413] <... set_robust_list resumed>) = 0 [pid 412] <... set_robust_list resumed>) = 0 [pid 403] ioctl(5, LOOP_CLR_FD [pid 414] rt_sigprocmask(SIG_SETMASK, [], [pid 413] rt_sigprocmask(SIG_SETMASK, [], [pid 412] rt_sigprocmask(SIG_SETMASK, [], [pid 414] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 413] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 412] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 414] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 413] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 412] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 409] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] <... futex resumed>) = 0 [pid 409] <... futex resumed>) = 1 [pid 412] memfd_create("syzkaller", 0 [pid 409] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] <... memfd_create resumed>) = 3 [pid 409] <... futex resumed>) = 0 [pid 412] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 409] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 412] <... mmap resumed>) = 0x7f0c41dee000 [pid 409] <... mmap resumed>) = 0x7f0c41dcd000 [pid 412] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 409] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 412] <... write resumed>) = 262144 [pid 409] <... mprotect resumed>) = 0 [pid 412] munmap(0x7f0c41dee000, 138412032 [pid 409] rt_sigprocmask(SIG_BLOCK, ~[], [pid 412] <... munmap resumed>) = 0 [pid 409] <... rt_sigprocmask resumed>[], 8) = 0 [pid 412] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 409] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 412] <... openat resumed>) = 4 [pid 412] ioctl(4, LOOP_SET_FD, 3 [pid 409] <... clone3 resumed> => {parent_tid=[415]}, 88) = 415 ./strace-static-x86_64: Process 415 attached [pid 411] <... ioctl resumed>) = 0 [pid 408] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 415] set_robust_list(0x7f0c41ded9a0, 24 [pid 411] close(3 [pid 408] <... futex resumed>) = 1 [pid 406] <... futex resumed>) = 1 [pid 296] close(3 [pid 415] <... set_robust_list resumed>) = 0 [pid 411] <... close resumed>) = 0 [pid 408] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... close resumed>) = 0 [pid 415] rt_sigprocmask(SIG_SETMASK, [], [pid 411] mkdir("./file1", 0777 [pid 408] <... futex resumed>) = 0 [pid 296] rmdir("./2" [pid 415] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 411] <... mkdir resumed>) = 0 [pid 408] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] <... rmdir resumed>) = 0 [pid 415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 411] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 408] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 296] mkdir("./3", 0777 [pid 408] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 296] <... mkdir resumed>) = 0 [pid 408] <... mprotect resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 408] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] <... openat resumed>) = 3 [pid 408] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] ioctl(3, LOOP_CLR_FD [pid 408] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] close(3./strace-static-x86_64: Process 416 attached [pid 414] <... futex resumed>) = 0 [pid 413] <... futex resumed>) = 0 [pid 412] <... ioctl resumed>) = 0 [pid 409] rt_sigprocmask(SIG_SETMASK, [], [pid 408] <... clone3 resumed> => {parent_tid=[416]}, 88) = 416 [pid 296] <... close resumed>) = 0 [pid 416] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 414] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 413] memfd_create("syzkaller", 0 [pid 412] close(3 [pid 409] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 408] rt_sigprocmask(SIG_SETMASK, [], [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 414] <... open resumed>) = 3 [pid 413] <... memfd_create resumed>) = 3 [pid 409] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 408] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 419 [pid 408] <... futex resumed>) = 0 [pid 408] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 419 attached [pid 419] set_robust_list(0x555556d8d6a0, 24 [pid 415] <... futex resumed>) = 0 [pid 409] <... futex resumed>) = 1 [pid 415] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 414] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 415] <... open resumed>) = 5 [pid 414] <... futex resumed>) = 1 [pid 412] <... close resumed>) = 0 [pid 409] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 406] <... futex resumed>) = 0 [pid 415] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] <... mmap resumed>) = 0x7f0c41dcd000 [pid 409] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 406] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... futex resumed>) = 0 [pid 414] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 412] mkdir("./bus", 0777 [pid 406] <... futex resumed>) = 0 [ 23.337902][ T403] EXT4-fs (loop3): 1 orphan inode deleted [ 23.348504][ T403] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.359579][ T403] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/3/file1 supports timestamps until 2038 (0x7fffffff) [ 23.374217][ T411] loop5: detected capacity change from 0 to 512 [ 23.380553][ T412] loop4: detected capacity change from 0 to 512 [pid 415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 409] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 415] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 415] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 419] <... set_robust_list resumed>) = 0 [pid 419] chdir("./3") = 0 [pid 419] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 419] setpgid(0, 0) = 0 [pid 419] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 413] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 415] <... futex resumed>) = 0 [pid 409] <... futex resumed>) = 1 [pid 415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 414] <... mount resumed>) = 0 [pid 412] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 409] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 419] <... openat resumed>) = 3 [pid 419] write(3, "1000", 4) = 4 [pid 419] close(3) = 0 [pid 419] symlink("/dev/binderfs", "./binderfs") = 0 [pid 419] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 419] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 419] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 419] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 419] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 419] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[420]}, 88) = 420 [pid 419] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 419] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 419] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 419] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 419] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[421]}, 88) = 421 [pid 419] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 419] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 421 attached [pid 421] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 421] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 421] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 421] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] <... futex resumed>) = 0 [pid 419] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 421] <... futex resumed>) = 1 [pid 421] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 421] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] <... futex resumed>) = 0 [pid 419] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 421] <... futex resumed>) = 1 [pid 421] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 421] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] <... futex resumed>) = 0 [pid 419] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 419] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 409] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 414] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 412] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 421] <... futex resumed>) = 1 [pid 421] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 414] <... futex resumed>) = 1 [pid 409] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] <... futex resumed>) = 0 [pid 406] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... futex resumed>) = 0 [pid 414] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 409] <... futex resumed>) = 1 [pid 406] <... futex resumed>) = 0 [pid 415] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 406] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] <... open resumed>) = 3 [pid 414] <... open resumed>) = 5 [pid 409] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 414] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... futex resumed>) = 0 [pid 409] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 414] <... futex resumed>) = 1 [pid 409] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] <... futex resumed>) = 0 [pid 415] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 406] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 406] <... futex resumed>) = 0 [pid 415] <... write resumed>) = 8 [pid 406] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] <... futex resumed>) = 0 [pid 419] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] <... write resumed>) = 262144 [pid 419] <... futex resumed>) = 0 [pid 415] <... futex resumed>) = 0 [pid 414] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 409] <... futex resumed>) = 1 [pid 419] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] <... futex resumed>) = 1 [pid 421] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 409] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 414] <... write resumed>) = 8 [pid 409] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 414] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 409] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 416] <... set_robust_list resumed>) = 0 [pid 415] <... futex resumed>) = 0 [pid 414] <... futex resumed>) = 1 [pid 413] munmap(0x7f0c41dcd000, 138412032 [pid 409] <... futex resumed>) = 1 [pid 406] <... futex resumed>) = 0 [pid 415] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 406] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 415] <... write resumed>) = 1045 [pid 406] <... futex resumed>) = 0 [pid 415] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 406] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 415] <... futex resumed>) = 0 [pid 415] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 421] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 421] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 419] <... futex resumed>) = 0 [pid 421] <... futex resumed>) = 1 [pid 421] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 420 attached [pid 420] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 420] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 420] memfd_create("syzkaller", 0) = 5 [pid 420] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 420] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 420] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 420] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 6 [pid 420] ioctl(6, LOOP_SET_FD, 5 [pid 416] rt_sigprocmask(SIG_SETMASK, [], [pid 414] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 413] <... munmap resumed>) = 0 [pid 409] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] <... ioctl resumed>) = 0 [pid 420] <... ioctl resumed>) = 0 [pid 420] close(5) = 0 [pid 420] mkdir("./file1", 0777) = 0 [pid 420] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 416] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 416] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 [pid 416] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 408] <... futex resumed>) = 0 [pid 416] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 408] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 416] <... mount resumed>) = 0 [pid 408] <... futex resumed>) = 0 [pid 416] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 416] <... futex resumed>) = 0 [pid 408] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 416] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 408] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 409] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 403] close(5 [pid 416] <... open resumed>) = 6 [pid 414] <... write resumed>) = 1045 [pid 413] <... openat resumed>) = 5 [pid 411] <... mount resumed>) = 0 [pid 408] <... futex resumed>) = 0 [pid 403] <... close resumed>) = 0 [pid 416] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 414] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 413] ioctl(5, LOOP_SET_FD, 3 [pid 408] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 403] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 416] <... futex resumed>) = 0 [pid 414] <... futex resumed>) = 1 [pid 408] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 406] <... futex resumed>) = 0 [pid 403] <... futex resumed>) = 0 [pid 400] exit_group(0 [pid 416] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 414] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 408] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 400] <... exit_group resumed>) = ? [pid 416] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 408] <... futex resumed>) = 0 [pid 403] +++ exited with 0 +++ [pid 416] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 408] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 416] <... futex resumed>) = 0 [pid 408] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 416] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 408] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 416] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 408] <... futex resumed>) = 0 [pid 416] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 408] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 416] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 416] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 408] <... futex resumed>) = 0 [pid 416] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 411] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = -1 ENOTDIR (Not a directory) [pid 411] ioctl(4, LOOP_CLR_FD) = 0 [pid 411] close(4) = 0 [pid 411] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 23.395863][ T411] EXT4-fs (loop5): 1 orphan inode deleted [ 23.405485][ T411] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.411930][ T420] loop2: detected capacity change from 0 to 512 [ 23.418409][ T411] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/3/file1 supports timestamps until 2038 (0x7fffffff) [pid 411] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 413] <... ioctl resumed>) = 0 [pid 406] exit_group(0 [pid 404] <... futex resumed>) = ? [pid 295] <... umount2 resumed>) = 0 [pid 414] <... futex resumed>) = ? [pid 413] close(3 [pid 411] <... futex resumed>) = ? [pid 406] <... exit_group resumed>) = ? [pid 414] +++ exited with 0 +++ [pid 413] <... close resumed>) = 0 [pid 411] +++ exited with 0 +++ [pid 404] +++ exited with 0 +++ [pid 400] +++ exited with 0 +++ [pid 413] mkdir("./bus", 0777 [pid 406] +++ exited with 0 +++ [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=400, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 413] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 413] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=406, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 295] newfstatat(AT_FDCWD, "./2/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./2/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./2/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... openat resumed>) = 4 [pid 299] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 295] newfstatat(4, "", [pid 299] newfstatat(3, "", [pid 297] newfstatat(3, "", [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] getdents64(4, [pid 299] getdents64(3, [pid 297] getdents64(3, [pid 299] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 295] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 299] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./3/binderfs") = 0 [pid 297] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./3/file1", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./3/file1") = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./3") = 0 [pid 297] mkdir("./4", 0777 [pid 299] <... umount2 resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 295] getdents64(4, [pid 299] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 295] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... openat resumed>) = 3 [pid 299] newfstatat(AT_FDCWD, "./3/bus", [pid 297] ioctl(3, LOOP_CLR_FD [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] unlink("./3/bus" [pid 297] close(3 [pid 299] <... unlink resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 299] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./3/binderfs", [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 428 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./3/binderfs") = 0 ./strace-static-x86_64: Process 428 attached [pid 299] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] close(4 [pid 428] set_robust_list(0x555556d8d6a0, 24 [pid 295] <... close resumed>) = 0 [pid 428] <... set_robust_list resumed>) = 0 [pid 295] rmdir("./2/file1" [pid 428] chdir("./4" [pid 295] <... rmdir resumed>) = 0 [pid 428] <... chdir resumed>) = 0 [pid 295] getdents64(3, [pid 428] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 428] <... prctl resumed>) = 0 [pid 295] close(3 [pid 428] setpgid(0, 0 [pid 295] <... close resumed>) = 0 [pid 428] <... setpgid resumed>) = 0 [pid 295] rmdir("./2" [pid 428] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 295] <... rmdir resumed>) = 0 [pid 428] <... openat resumed>) = 3 [pid 295] mkdir("./3", 0777 [pid 428] write(3, "1000", 4 [pid 295] <... mkdir resumed>) = 0 [pid 428] <... write resumed>) = 4 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 428] close(3 [pid 295] <... openat resumed>) = 3 [pid 428] <... close resumed>) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 428] symlink("/dev/binderfs", "./binderfs" [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 428] <... symlink resumed>) = 0 [ 23.436509][ T412] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 23.448614][ T413] loop0: detected capacity change from 0 to 512 [ 23.468282][ T412] EXT4-fs (loop4): get root inode failed [ 23.475810][ T412] EXT4-fs (loop4): mount failed [ 23.485747][ T420] EXT4-fs (loop2): 1 orphan inode deleted [pid 295] close(3 [pid 428] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... close resumed>) = 0 [pid 428] <... futex resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 428] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 429 [pid 428] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 428] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 428] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 428] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 428] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[430]}, 88) = 430 [pid 428] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 428] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 428] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 428] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 428] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 428] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 428] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[431]}, 88) = 431 [pid 428] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 428] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 428] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 429 attached ./strace-static-x86_64: Process 430 attached ./strace-static-x86_64: Process 431 attached [pid 431] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 430] set_robust_list(0x7f0c4a20e9a0, 24 [pid 429] set_robust_list(0x555556d8d6a0, 24 [pid 431] <... set_robust_list resumed>) = 0 [pid 430] <... set_robust_list resumed>) = 0 [pid 429] <... set_robust_list resumed>) = 0 [pid 412] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 431] rt_sigprocmask(SIG_SETMASK, [], [pid 430] rt_sigprocmask(SIG_SETMASK, [], [pid 431] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 429] chdir("./3" [pid 412] ioctl(4, LOOP_CLR_FD [pid 430] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 431] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 429] <... chdir resumed>) = 0 [pid 430] memfd_create("syzkaller", 0 [pid 429] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 412] <... ioctl resumed>) = 0 [pid 431] <... open resumed>) = 3 [pid 430] <... memfd_create resumed>) = 4 [pid 429] <... prctl resumed>) = 0 [pid 420] <... mount resumed>) = 0 [pid 412] close(4 [pid 420] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 420] chdir("./file1") = 0 [pid 420] ioctl(6, LOOP_CLR_FD) = 0 [pid 420] close(6) = 0 [pid 420] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 420] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 431] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 428] <... futex resumed>) = 0 [pid 431] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 428] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 431] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 428] <... futex resumed>) = 0 [pid 431] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 428] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 431] <... futex resumed>) = 0 [pid 428] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 431] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 428] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 431] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 428] <... futex resumed>) = 0 [pid 431] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 428] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 431] <... futex resumed>) = 0 [pid 428] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 431] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 428] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 431] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 428] <... futex resumed>) = 0 [pid 431] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 428] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 431] <... futex resumed>) = 0 [pid 428] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 431] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 428] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 431] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 428] <... futex resumed>) = 0 [ 23.492218][ T413] EXT4-fs (loop0): 1 orphan inode deleted [ 23.504386][ T413] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.508395][ T420] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.527830][ T420] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/3/file1 supports timestamps until 2038 (0x7fffffff) [pid 431] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 428] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 431] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 431] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 428] <... futex resumed>) = 0 [pid 431] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 430] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 430] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 429] setpgid(0, 0 [pid 412] <... close resumed>) = 0 [pid 430] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 430] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 5 [pid 430] ioctl(5, LOOP_SET_FD, 4 [pid 429] <... setpgid resumed>) = 0 [pid 412] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 429] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 419] exit_group(0 [pid 412] <... futex resumed>) = 0 [pid 429] <... openat resumed>) = 3 [pid 421] <... futex resumed>) = ? [pid 419] <... exit_group resumed>) = ? [pid 412] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 409] exit_group(0 [pid 429] write(3, "1000", 4 [pid 421] +++ exited with 0 +++ [pid 415] <... futex resumed>) = ? [pid 412] <... futex resumed>) = ? [pid 409] <... exit_group resumed>) = ? [pid 429] <... write resumed>) = 4 [pid 415] +++ exited with 0 +++ [pid 420] <... futex resumed>) = ? [pid 429] close(3) = 0 [pid 429] symlink("/dev/binderfs", "./binderfs") = 0 [pid 429] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 429] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 429] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 429] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 429] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 420] +++ exited with 0 +++ [pid 419] +++ exited with 0 +++ [pid 429] <... mprotect resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=419, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 429] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 296] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 296] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(3, [pid 429] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 429] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 296] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 429] <... clone3 resumed> => {parent_tid=[432]}, 88) = 432 [pid 296] <... umount2 resumed>) = 0 [pid 429] rt_sigprocmask(SIG_SETMASK, [], [pid 299] <... umount2 resumed>) = 0 [pid 296] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 429] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 429] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 429] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./3/file1", [pid 296] newfstatat(AT_FDCWD, "./3/bus", [pid 429] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 429] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 429] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./3/bus" [pid 429] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 432 attached [pid 430] <... ioctl resumed>) = 0 [pid 299] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... unlink resumed>) = 0 [pid 429] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 299] <... openat resumed>) = 4 [pid 296] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 429] <... mprotect resumed>) = 0 [pid 299] newfstatat(4, "", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] newfstatat(AT_FDCWD, "./3/binderfs", [pid 299] getdents64(4, [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 429] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 429] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] unlink("./3/binderfs" [pid 430] close(4 [pid 429] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 299] getdents64(4, [pid 430] <... close resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 430] mkdir("./file1", 0777 [pid 429] <... clone3 resumed> => {parent_tid=[433]}, 88) = 433 [pid 299] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 430] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 429] rt_sigprocmask(SIG_SETMASK, [], [pid 299] close(4 [pid 430] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 429] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 429] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 429] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... close resumed>) = 0 [pid 432] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 432] rt_sigprocmask(SIG_SETMASK, [], [pid 299] rmdir("./3/file1" [pid 432] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 432] memfd_create("syzkaller", 0 [pid 299] <... rmdir resumed>) = 0 [pid 432] <... memfd_create resumed>) = 3 [pid 432] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 299] getdents64(3, [pid 432] <... mmap resumed>) = 0x7f0c41dcd000 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./3" [pid 413] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 413] ioctl(5, LOOP_CLR_FD) = 0 [pid 413] close(5) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 299] mkdir("./4", 0777 [pid 413] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... mkdir resumed>) = 0 [pid 413] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 413] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 433 attached [pid 299] <... openat resumed>) = 3 [pid 299] ioctl(3, LOOP_CLR_FD [pid 408] exit_group(0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 416] <... futex resumed>) = ? [pid 413] <... futex resumed>) = ? [pid 408] <... exit_group resumed>) = ? [pid 299] close(3 [pid 416] +++ exited with 0 +++ [pid 299] <... close resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 413] +++ exited with 0 +++ ./strace-static-x86_64: Process 434 attached [pid 433] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 432] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 434 [pid 433] <... set_robust_list resumed>) = 0 [pid 433] rt_sigprocmask(SIG_SETMASK, [], [pid 434] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 433] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 432] <... write resumed>) = 262144 [pid 433] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 432] munmap(0x7f0c41dcd000, 138412032 [pid 433] <... open resumed>) = 4 [pid 432] <... munmap resumed>) = 0 [pid 433] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 432] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 434] chdir("./4" [pid 433] <... futex resumed>) = 1 [pid 432] <... openat resumed>) = 5 [pid 429] <... futex resumed>) = 0 [pid 434] <... chdir resumed>) = 0 [pid 433] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 432] ioctl(5, LOOP_SET_FD, 3 [pid 429] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 433] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 432] <... ioctl resumed>) = 0 [pid 429] <... futex resumed>) = 0 [pid 434] <... prctl resumed>) = 0 [pid 433] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 429] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 434] setpgid(0, 0 [pid 433] <... mount resumed>) = 0 [pid 434] <... setpgid resumed>) = 0 [pid 433] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 433] <... futex resumed>) = 1 [pid 429] <... futex resumed>) = 0 [pid 434] <... openat resumed>) = 3 [pid 433] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 429] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] write(3, "1000", 4 [pid 433] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 429] <... futex resumed>) = 0 [pid 434] <... write resumed>) = 4 [pid 433] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 429] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 434] close(3 [pid 433] <... open resumed>) = 6 [pid 434] <... close resumed>) = 0 [pid 433] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] symlink("/dev/binderfs", "./binderfs" [pid 433] <... futex resumed>) = 1 [ 23.528338][ T413] ext4 filesystem being mounted at /root/syzkaller.iF59aB/3/bus supports timestamps until 2038 (0x7fffffff) [ 23.553110][ T430] loop3: detected capacity change from 0 to 512 [ 23.582162][ T432] loop1: detected capacity change from 0 to 512 [pid 429] <... futex resumed>) = 0 [pid 434] <... symlink resumed>) = 0 [pid 433] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 429] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 433] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 429] <... futex resumed>) = 0 [pid 434] <... futex resumed>) = 0 [pid 433] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 429] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 434] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 434] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 434] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 434] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 434] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 434] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[437]}, 88) = 437 [pid 434] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 434] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 434] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 434] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 434] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[438]}, 88) = 438 [pid 434] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 434] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 432] close(3) = 0 [pid 432] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 432] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 412] +++ exited with 0 +++ [pid 409] +++ exited with 0 +++ [pid 408] +++ exited with 0 +++ ./strace-static-x86_64: Process 437 attached [pid 437] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 437] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 437] memfd_create("syzkaller", 0) = 3 [pid 437] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 296] <... umount2 resumed>) = 0 [pid 437] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 437] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 437] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 437] ioctl(4, LOOP_SET_FD, 3 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=409, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 296] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 433] <... write resumed>) = 8 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=408, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 433] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] newfstatat(AT_FDCWD, "./3/file1", [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... restart_syscall resumed>) = 0 [pid 433] <... futex resumed>) = 1 [pid 429] <... futex resumed>) = 0 [pid 298] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./3/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 433] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 429] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 429] <... futex resumed>) = 0 [pid 429] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] openat(AT_FDCWD, "./3/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 4 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(3, "", [pid 296] newfstatat(4, "", [pid 294] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 433] <... write resumed>) = 1045 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 432] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 432] ioctl(5, LOOP_CLR_FD) = 0 [pid 432] close(5) = 0 [pid 432] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 432] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 437] <... ioctl resumed>) = 0 [pid 437] close(3) = 0 [pid 437] mkdir("./file1", 0777) = 0 [pid 437] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 438 attached [pid 438] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 438] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 438] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 438] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] <... futex resumed>) = 0 [pid 434] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 438] <... futex resumed>) = 1 [pid 438] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL) = 0 [pid 438] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] <... futex resumed>) = 0 [pid 434] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 434] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 438] <... futex resumed>) = 1 [pid 438] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] close(4) = 0 [pid 296] rmdir("./3/file1") = 0 [pid 296] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./3") = 0 [pid 296] mkdir("./4", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 439 [pid 294] <... openat resumed>) = 3 [pid 294] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] getdents64(3, [pid 294] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 433] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./3/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./3/bus" [pid 433] <... futex resumed>) = 1 [pid 429] <... futex resumed>) = 0 [pid 298] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... unlink resumed>) = 0 [pid 433] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 429] exit_group(0 [pid 298] <... umount2 resumed>) = 0 [pid 294] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 433] <... futex resumed>) = ? [pid 429] <... exit_group resumed>) = ? [pid 298] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 433] +++ exited with 0 +++ [pid 294] newfstatat(AT_FDCWD, "./3/binderfs", [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] newfstatat(AT_FDCWD, "./3/bus", [pid 294] unlink("./3/binderfs") = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./3") = 0 [pid 294] mkdir("./4", 0777) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 432] <... futex resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 298] unlink("./3/bus" [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] <... unlink resumed>) = 0 [pid 294] close(3 [pid 298] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... close resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] newfstatat(AT_FDCWD, "./3/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 440 [pid 298] unlink("./3/binderfs" [pid 438] <... open resumed>) = 5 [pid 298] <... unlink resumed>) = 0 [pid 298] getdents64(3, [pid 438] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 438] <... futex resumed>) = 1 [pid 434] <... futex resumed>) = 0 [pid 298] close(3 [pid 438] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 434] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... close resumed>) = 0 [pid 438] <... write resumed>) = 8 [pid 434] <... futex resumed>) = 0 [pid 298] rmdir("./3" [pid 438] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 434] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 438] <... futex resumed>) = 0 [pid 434] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] <... rmdir resumed>) = 0 [pid 438] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 434] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] mkdir("./4", 0777 [pid 434] <... futex resumed>) = 0 [pid 434] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... mkdir resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 438] <... write resumed>) = 1045 [pid 298] <... openat resumed>) = 3 [pid 438] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] ioctl(3, LOOP_CLR_FD [pid 438] <... futex resumed>) = 1 [pid 434] <... futex resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 438] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] close(3) = 0 [ 23.592822][ T430] EXT4-fs (loop3): 1 orphan inode deleted [ 23.604306][ T437] loop5: detected capacity change from 0 to 512 [ 23.611967][ T432] EXT4-fs (loop1): Invalid log block size: 2475723007 [ 23.613211][ T430] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 441 attached ./strace-static-x86_64: Process 440 attached ./strace-static-x86_64: Process 439 attached , child_tidptr=0x555556d8d690) = 441 [pid 440] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 440] chdir("./4") = 0 [pid 440] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 440] setpgid(0, 0) = 0 [pid 440] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 440] write(3, "1000", 4) = 4 [pid 440] close(3) = 0 [pid 440] symlink("/dev/binderfs", "./binderfs") = 0 [pid 440] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 440] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 440] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 440] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 440] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 440] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[442]}, 88) = 442 [pid 440] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 440] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 440] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 439] set_robust_list(0x555556d8d6a0, 24 [pid 440] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 439] <... set_robust_list resumed>) = 0 [pid 440] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 439] chdir("./4" [pid 440] <... mprotect resumed>) = 0 [pid 439] <... chdir resumed>) = 0 [pid 440] rt_sigprocmask(SIG_BLOCK, ~[], [pid 439] prctl(PR_SET_PDEATHSIG, SIGKILL./strace-static-x86_64: Process 442 attached [pid 441] set_robust_list(0x555556d8d6a0, 24 [pid 440] <... rt_sigprocmask resumed>[], 8) = 0 [pid 439] <... prctl resumed>) = 0 [pid 441] <... set_robust_list resumed>) = 0 [pid 441] chdir("./4") = 0 [pid 441] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 441] setpgid(0, 0) = 0 [pid 441] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 441] write(3, "1000", 4) = 4 [pid 441] close(3) = 0 [pid 441] symlink("/dev/binderfs", "./binderfs") = 0 [pid 441] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 441] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 441] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 441] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 441] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 441] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[444]}, 88) = 444 [pid 441] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 441] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 441] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 442] set_robust_list(0x7f0c4a20e9a0, 24 [pid 441] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 442] <... set_robust_list resumed>) = 0 [pid 441] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 442] rt_sigprocmask(SIG_SETMASK, [], [pid 441] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 442] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 441] <... mprotect resumed>) = 0 [pid 442] memfd_create("syzkaller", 0 [pid 441] rt_sigprocmask(SIG_BLOCK, ~[], [pid 442] <... memfd_create resumed>) = 3 [pid 441] <... rt_sigprocmask resumed>[], 8) = 0 [pid 442] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 441] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 442] <... mmap resumed>) = 0x7f0c41dcd000 [pid 442] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 441] <... clone3 resumed> => {parent_tid=[445]}, 88) = 445 [pid 440] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 439] setpgid(0, 0 [pid 432] +++ exited with 0 +++ [pid 429] +++ exited with 0 +++ [pid 441] rt_sigprocmask(SIG_SETMASK, [], [pid 439] <... setpgid resumed>) = 0 [pid 441] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 440] <... clone3 resumed> => {parent_tid=[446]}, 88) = 446 [pid 439] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=429, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 441] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 440] rt_sigprocmask(SIG_SETMASK, [], [pid 439] <... openat resumed>) = 3 [pid 441] <... futex resumed>) = 0 [pid 440] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 439] write(3, "1000", 4 [pid 441] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 440] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] <... write resumed>) = 4 [pid 295] umount2("./3", MNT_DETACH|UMOUNT_NOFOLLOW [pid 442] <... write resumed>) = 262144 [pid 440] <... futex resumed>) = 0 [pid 439] close(3 [pid 430] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 446 attached [pid 442] munmap(0x7f0c41dcd000, 138412032 [pid 440] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... close resumed>) = 0 [pid 430] ioctl(5, LOOP_CLR_FD [pid 295] openat(AT_FDCWD, "./3", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 445 attached [pid 446] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 442] <... munmap resumed>) = 0 [pid 439] symlink("/dev/binderfs", "./binderfs" [pid 295] <... openat resumed>) = 3 [pid 446] <... set_robust_list resumed>) = 0 [pid 445] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 442] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 439] <... symlink resumed>) = 0 [pid 295] newfstatat(3, "", ./strace-static-x86_64: Process 444 attached [pid 446] rt_sigprocmask(SIG_SETMASK, [], [pid 445] <... set_robust_list resumed>) = 0 [pid 442] <... openat resumed>) = 4 [pid 439] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 446] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 445] rt_sigprocmask(SIG_SETMASK, [], [pid 444] set_robust_list(0x7f0c4a20e9a0, 24 [pid 442] ioctl(4, LOOP_SET_FD, 3 [pid 439] <... futex resumed>) = 0 [pid 446] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 445] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 444] <... set_robust_list resumed>) = 0 [pid 439] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 295] getdents64(3, [pid 446] <... open resumed>) = 5 [pid 445] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 444] rt_sigprocmask(SIG_SETMASK, [], [pid 439] <... rt_sigaction resumed>NULL, 8) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 446] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 445] <... open resumed>) = 3 [pid 444] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 439] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 295] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 446] <... futex resumed>) = 1 [pid 445] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] memfd_create("syzkaller", 0 [pid 440] <... futex resumed>) = 0 [pid 439] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 442] <... ioctl resumed>) = 0 [pid 442] close(3) = 0 [pid 442] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 442] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 446] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 445] <... futex resumed>) = 1 [pid 444] <... memfd_create resumed>) = 4 [pid 441] <... futex resumed>) = 0 [pid 440] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] umount2("./3/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 441] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [ 23.644850][ T430] ext4 filesystem being mounted at /root/syzkaller.yAZgI2/4/file1 supports timestamps until 2038 (0x7fffffff) [ 23.679913][ T442] loop0: detected capacity change from 0 to 512 [pid 441] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 446] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 445] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 444] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 440] <... futex resumed>) = 0 [pid 439] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 446] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 445] <... mount resumed>) = 0 [pid 444] <... mmap resumed>) = 0x7f0c41dcd000 [pid 440] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] newfstatat(AT_FDCWD, "./3/bus", [pid 439] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 446] <... mount resumed>) = 0 [pid 439] <... mprotect resumed>) = 0 [pid 444] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 430] <... ioctl resumed>) = 0 [pid 445] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] rt_sigprocmask(SIG_BLOCK, ~[], [pid 446] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] unlink("./3/bus" [pid 445] <... futex resumed>) = 1 [pid 441] <... futex resumed>) = 0 [pid 430] close(5 [pid 441] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 439] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] <... unlink resumed>) = 0 [pid 446] <... futex resumed>) = 1 [pid 445] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 444] <... write resumed>) = 262144 [pid 441] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 440] <... futex resumed>) = 0 [pid 430] <... close resumed>) = 0 [pid 446] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 445] <... open resumed>) = 5 [pid 444] munmap(0x7f0c41dcd000, 138412032 [pid 440] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 295] umount2("./3/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 448 attached [pid 446] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 445] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] <... munmap resumed>) = 0 [pid 440] <... futex resumed>) = 0 [pid 430] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 428] exit_group(0 [pid 431] <... futex resumed>) = ? [pid 428] <... exit_group resumed>) = ? [pid 431] +++ exited with 0 +++ [pid 448] set_robust_list(0x7f0c4a20e9a0, 24 [pid 446] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 445] <... futex resumed>) = 1 [pid 444] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 440] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... clone3 resumed> => {parent_tid=[448]}, 88) = 448 [pid 295] newfstatat(AT_FDCWD, "./3/binderfs", [pid 448] <... set_robust_list resumed>) = 0 [pid 446] <... open resumed>) = 3 [pid 445] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 444] <... openat resumed>) = 6 [pid 441] <... futex resumed>) = 0 [pid 439] rt_sigprocmask(SIG_SETMASK, [], [pid 430] <... futex resumed>) = ? [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 448] rt_sigprocmask(SIG_SETMASK, [], [pid 446] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] ioctl(6, LOOP_SET_FD, 4 [pid 441] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 445] <... futex resumed>) = 0 [pid 441] <... futex resumed>) = 1 [pid 439] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 430] +++ exited with 0 +++ [pid 428] +++ exited with 0 +++ [pid 295] unlink("./3/binderfs" [pid 445] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 441] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... futex resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [ 23.690482][ T437] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 23.716519][ T437] EXT4-fs (loop5): get root inode failed [ 23.724437][ T437] EXT4-fs (loop5): mount failed [ 23.730399][ T444] loop4: detected capacity change from 0 to 512 [pid 439] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 446] <... futex resumed>) = 1 [pid 440] <... futex resumed>) = 0 [pid 439] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 445] <... write resumed>) = -1 EIO (Input/output error) [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=428, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 440] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 446] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 440] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 445] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 448] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 446] <... write resumed>) = 8 [pid 445] <... futex resumed>) = 1 [pid 444] <... ioctl resumed>) = 0 [pid 441] <... futex resumed>) = 0 [pid 439] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 437] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] getdents64(3, [pid 448] memfd_create("syzkaller", 0 [pid 446] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 445] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 441] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] <... mprotect resumed>) = 0 [pid 441] <... futex resumed>) = 0 [pid 445] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 446] <... futex resumed>) = 1 [pid 440] <... futex resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 448] <... memfd_create resumed>) = 3 [pid 445] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 441] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 440] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 439] rt_sigprocmask(SIG_BLOCK, ~[], [pid 446] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 297] <... openat resumed>) = 3 [pid 295] close(3 [pid 444] close(4 [pid 448] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 440] <... futex resumed>) = 0 [pid 440] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 439] <... rt_sigprocmask resumed>[], 8) = 0 [pid 437] ioctl(4, LOOP_CLR_FD [pid 297] newfstatat(3, "", [pid 295] <... close resumed>) = 0 [pid 448] <... mmap resumed>) = 0x7f0c41dcd000 [pid 446] <... write resumed>) = 1045 [pid 445] <... write resumed>) = 1045 [pid 444] <... close resumed>) = 0 [pid 439] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] rmdir("./3" [pid 437] <... ioctl resumed>) = 0 [pid 437] close(4) = 0 [pid 437] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 437] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 446] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 445] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 444] mkdir("./file1", 0777 [pid 297] getdents64(3, [pid 295] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 451 attached [pid 451] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 448] <... write resumed>) = 262144 [pid 446] <... futex resumed>) = 1 [pid 445] <... futex resumed>) = 1 [pid 441] <... futex resumed>) = 0 [pid 440] <... futex resumed>) = 0 [pid 439] <... clone3 resumed> => {parent_tid=[451]}, 88) = 451 [pid 434] exit_group(0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 295] mkdir("./4", 0777 [pid 448] munmap(0x7f0c41dcd000, 138412032 [pid 446] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 445] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 439] rt_sigprocmask(SIG_SETMASK, [], [pid 438] <... futex resumed>) = ? [pid 437] <... futex resumed>) = ? [pid 434] <... exit_group resumed>) = ? [pid 297] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... mkdir resumed>) = 0 [pid 448] <... munmap resumed>) = 0 [pid 444] <... mkdir resumed>) = 0 [pid 439] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 438] +++ exited with 0 +++ [pid 437] +++ exited with 0 +++ [pid 434] +++ exited with 0 +++ [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 448] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 444] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 439] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] newfstatat(AT_FDCWD, "./4/binderfs", [pid 295] <... openat resumed>) = 3 [pid 439] <... futex resumed>) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=434, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 439] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./4/binderfs" [pid 299] <... restart_syscall resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 297] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] ioctl(3, LOOP_CLR_FD [pid 451] rt_sigprocmask(SIG_SETMASK, [], [pid 448] <... openat resumed>) = 4 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 448] ioctl(4, LOOP_SET_FD, 3 [pid 299] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] newfstatat(AT_FDCWD, "./4/file1", [pid 295] close(3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... close resumed>) = 0 [pid 451] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 451] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 5 [pid 451] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 451] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] <... ioctl resumed>) = 0 [pid 448] close(3) = 0 [pid 299] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] unlink("./4/file1" [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 444] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 439] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 297] <... unlink resumed>) = 0 [pid 448] mkdir("./bus", 0777 [pid 439] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(3, "", [pid 444] ioctl(6, LOOP_CLR_FD [pid 297] getdents64(3, [pid 439] <... futex resumed>) = 1 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 452 [pid 451] <... futex resumed>) = 0 [pid 444] <... ioctl resumed>) = 0 [pid 439] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 444] close(6 [pid 299] getdents64(3, [pid 297] close(3 [pid 444] <... close resumed>) = 0 [pid 451] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 444] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 297] <... close resumed>) = 0 [pid 444] <... futex resumed>) = 0 [pid 441] exit_group(0 [pid 299] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] rmdir("./4" [pid 445] <... futex resumed>) = ? [pid 441] <... exit_group resumed>) = ? [pid 451] <... mount resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 451] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 445] +++ exited with 0 +++ [pid 297] <... rmdir resumed>) = 0 [pid 451] <... futex resumed>) = 1 [pid 451] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 448] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 439] <... futex resumed>) = 0 [pid 439] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] mkdir("./5", 0777 [pid 451] <... futex resumed>) = 0 [pid 439] <... futex resumed>) = 1 [pid 451] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 439] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... mkdir resumed>) = 0 [pid 451] <... open resumed>) = 3 [pid 299] newfstatat(AT_FDCWD, "./4/bus", [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 451] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 451] <... futex resumed>) = 1 [pid 439] <... futex resumed>) = 0 [pid 299] unlink("./4/bus" [pid 451] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 439] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... openat resumed>) = 3 [pid 439] <... futex resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 439] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 451] <... write resumed>) = 8 [pid 299] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 451] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] ioctl(3, LOOP_CLR_FD [pid 451] <... futex resumed>) = 1 [pid 439] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 451] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 439] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 451] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 439] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./4/binderfs", [pid 297] close(3 [pid 451] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 439] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 448] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 451] <... write resumed>) = 1045 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 451] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] unlink("./4/binderfs" [pid 297] <... close resumed>) = 0 [pid 451] <... futex resumed>) = 1 [pid 439] <... futex resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 451] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./4/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 453 [pid 299] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 299] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 299] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 299] close(4) = 0 [pid 299] rmdir("./4/file1" [pid 442] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 453 attached ./strace-static-x86_64: Process 452 attached [pid 442] ioctl(4, LOOP_CLR_FD) = 0 [ 23.737020][ T54] blk_update_request: I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 23.754796][ T442] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 23.769956][ T444] EXT4-fs (loop4): bad geometry: block count 3888436996 exceeds size of device (64 blocks) [ 23.770348][ T448] loop2: detected capacity change from 0 to 512 [ 23.780408][ T442] EXT4-fs (loop0): get root inode failed [ 23.792337][ T442] EXT4-fs (loop0): mount failed [pid 442] close(4) = 0 [pid 442] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 442] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./4") = 0 [pid 299] mkdir("./5", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 453] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 453] chdir("./5") = 0 [pid 453] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 453] setpgid(0, 0) = 0 [pid 453] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 453] write(3, "1000", 4 [pid 452] set_robust_list(0x555556d8d6a0, 24 [pid 448] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 452] <... set_robust_list resumed>) = 0 [pid 448] ioctl(4, LOOP_CLR_FD [pid 452] chdir("./4" [pid 448] <... ioctl resumed>) = 0 [pid 453] <... write resumed>) = 4 [pid 452] <... chdir resumed>) = 0 [pid 452] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 448] close(4 [pid 440] exit_group(0 [pid 452] <... prctl resumed>) = 0 [pid 448] <... close resumed>) = 0 [pid 446] <... futex resumed>) = ? [pid 442] <... futex resumed>) = ? [pid 440] <... exit_group resumed>) = ? [pid 453] close(3) = 0 [pid 452] setpgid(0, 0 [pid 448] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 446] +++ exited with 0 +++ [pid 439] exit_group(0 [pid 453] symlink("/dev/binderfs", "./binderfs" [pid 452] <... setpgid resumed>) = 0 [pid 451] <... futex resumed>) = ? [pid 448] <... futex resumed>) = ? [pid 439] <... exit_group resumed>) = ? [pid 453] <... symlink resumed>) = 0 [pid 452] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 451] +++ exited with 0 +++ [pid 453] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] <... openat resumed>) = 3 [pid 453] <... futex resumed>) = 0 [pid 452] write(3, "1000", 4) = 4 [pid 452] close(3) = 0 [pid 452] symlink("/dev/binderfs", "./binderfs") = 0 [pid 452] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 452] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 452] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 452] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 452] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 453] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 452] <... mprotect resumed>) = 0 [pid 453] <... rt_sigaction resumed>NULL, 8) = 0 [pid 452] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 452] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0}./strace-static-x86_64: Process 454 attached [pid 453] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 452] <... clone3 resumed> => {parent_tid=[454]}, 88) = 454 [pid 452] rt_sigprocmask(SIG_SETMASK, [], [pid 453] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 452] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 453] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 452] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 453] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 452] <... futex resumed>) = 0 [pid 453] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 452] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 453] <... mprotect resumed>) = 0 [pid 452] <... futex resumed>) = 0 [pid 452] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 452] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 453] rt_sigprocmask(SIG_BLOCK, ~[], [pid 452] <... mprotect resumed>) = 0 [pid 453] <... rt_sigprocmask resumed>[], 8) = 0 [pid 452] rt_sigprocmask(SIG_BLOCK, ~[], [pid 454] set_robust_list(0x7f0c4a20e9a0, 24 [pid 453] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 452] <... rt_sigprocmask resumed>[], 8) = 0 [pid 452] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 453] <... clone3 resumed> => {parent_tid=[455]}, 88) = 455 [pid 453] rt_sigprocmask(SIG_SETMASK, [], [pid 452] <... clone3 resumed> => {parent_tid=[456]}, 88) = 456 [pid 453] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 452] rt_sigprocmask(SIG_SETMASK, [], [pid 454] <... set_robust_list resumed>) = 0 [pid 453] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 453] <... futex resumed>) = 0 [pid 452] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 453] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] <... futex resumed>) = 0 [pid 453] <... futex resumed>) = 0 [pid 452] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 453] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 455 attached ) = 0x7f0c4a1cd000 [pid 455] set_robust_list(0x7f0c4a20e9a0, 24 [pid 453] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 455] <... set_robust_list resumed>) = 0 [pid 453] <... mprotect resumed>) = 0 [pid 455] rt_sigprocmask(SIG_SETMASK, [], [pid 453] rt_sigprocmask(SIG_BLOCK, ~[], [pid 455] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 453] <... rt_sigprocmask resumed>[], 8) = 0 [pid 453] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[457]}, 88) = 457 [pid 453] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 453] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 453] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 455] memfd_create("syzkaller", 0 [pid 454] rt_sigprocmask(SIG_SETMASK, [], [pid 455] <... memfd_create resumed>) = 3 [pid 454] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 455] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 455] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 454] memfd_create("syzkaller", 0./strace-static-x86_64: Process 456 attached ) = 3 [pid 456] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 456] rt_sigprocmask(SIG_SETMASK, [], [pid 454] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 456] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 456] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 4 [pid 454] <... mmap resumed>) = 0x7f0c41dcd000 [pid 456] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] <... futex resumed>) = 0 [pid 452] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 452] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 456] <... futex resumed>) = 1 [pid 456] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 456] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 457 attached ) = 1 [pid 454] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 452] <... futex resumed>) = 0 [pid 444] +++ exited with 0 +++ [pid 442] +++ exited with 0 +++ [pid 441] +++ exited with 0 +++ [pid 440] +++ exited with 0 +++ [pid 299] <... openat resumed>) = 3 [pid 457] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 454] <... write resumed>) = 262144 [pid 452] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 448] +++ exited with 0 +++ [pid 439] +++ exited with 0 +++ [pid 299] ioctl(3, LOOP_CLR_FD [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=441, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=440, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 457] <... set_robust_list resumed>) = 0 [pid 456] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 455] <... write resumed>) = 262144 [pid 454] munmap(0x7f0c41dcd000, 138412032 [pid 452] <... futex resumed>) = 0 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 457] rt_sigprocmask(SIG_SETMASK, [], [pid 456] <... open resumed>) = 5 [pid 455] munmap(0x7f0c41dcd000, 138412032 [pid 454] <... munmap resumed>) = 0 [pid 452] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] close(3 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=439, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 457] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 456] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] <... munmap resumed>) = 0 [pid 454] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 452] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] <... close resumed>) = 0 [pid 298] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 457] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 456] <... futex resumed>) = 0 [pid 455] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 454] <... openat resumed>) = 6 [pid 452] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 457] <... open resumed>) = 4 [pid 456] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 455] <... openat resumed>) = 5 [ 23.808454][ T448] EXT4-fs (loop2): Invalid log block size: 2475723007 [pid 454] ioctl(6, LOOP_SET_FD, 3 [pid 452] <... futex resumed>) = 0 [pid 298] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 457] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 455] ioctl(5, LOOP_SET_FD, 3 [pid 454] <... ioctl resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 458 [pid 298] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 294] <... openat resumed>) = 3 [pid 457] <... futex resumed>) = 1 [pid 453] <... futex resumed>) = 0 [pid 298] newfstatat(3, "", [pid 296] newfstatat(3, "", [pid 294] newfstatat(3, "", [pid 457] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 453] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 457] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 456] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 453] <... futex resumed>) = 0 [pid 452] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] getdents64(3, [pid 296] getdents64(3, [pid 294] getdents64(3, [pid 457] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 453] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 457] <... mount resumed>) = 0 [pid 298] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 457] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 453] <... futex resumed>) = 0 [pid 457] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 453] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 453] <... futex resumed>) = 0 [pid 457] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 453] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 454] close(3) = 0 [pid 454] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 454] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 458 attached [pid 458] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 458] chdir("./5") = 0 [pid 458] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 458] setpgid(0, 0) = 0 [pid 458] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 458] write(3, "1000", 4) = 4 [pid 458] close(3) = 0 [pid 458] symlink("/dev/binderfs", "./binderfs") = 0 [pid 458] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 458] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 458] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 458] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 458] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 458] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 458] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[459]}, 88) = 459 [pid 456] <... futex resumed>) = 0 [pid 452] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] <... umount2 resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 456] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 452] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 456] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 452] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 456] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 298] newfstatat(AT_FDCWD, "./4/bus", [pid 296] newfstatat(AT_FDCWD, "./4/bus", [pid 294] newfstatat(AT_FDCWD, "./4/bus", [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./4/bus" [pid 296] unlink("./4/bus" [pid 294] unlink("./4/bus" [pid 456] <... write resumed>) = 1045 [pid 452] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... unlink resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 458] rt_sigprocmask(SIG_SETMASK, [], [pid 456] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 458] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 456] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 458] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] newfstatat(AT_FDCWD, "./4/binderfs", [pid 296] newfstatat(AT_FDCWD, "./4/binderfs", [pid 294] newfstatat(AT_FDCWD, "./4/binderfs", [pid 458] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 458] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] unlink("./4/binderfs" [pid 296] unlink("./4/binderfs" [pid 294] unlink("./4/binderfs" [pid 458] <... futex resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 458] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] getdents64(3, [pid 294] getdents64(3, [pid 458] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 458] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 298] newfstatat(AT_FDCWD, "./4/file1", [pid 296] close(3 [pid 294] close(3 [pid 458] <... mprotect resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 458] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] umount2("./4/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] rmdir("./4" [pid 294] rmdir("./4" [pid 458] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... rmdir resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 458] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 298] openat(AT_FDCWD, "./4/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] mkdir("./5", 0777 [pid 294] mkdir("./5", 0777 [pid 457] <... open resumed>) = 6 [pid 455] <... ioctl resumed>) = 0 [pid 298] <... openat resumed>) = 4 [pid 296] <... mkdir resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 458] <... clone3 resumed> => {parent_tid=[461]}, 88) = 461 [pid 457] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(4, "", [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 458] rt_sigprocmask(SIG_SETMASK, [], [pid 457] <... futex resumed>) = 1 [pid 455] close(3 [pid 453] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... openat resumed>) = 3 [pid 294] <... openat resumed>) = 3 [pid 458] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 457] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 453] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(4, [pid 296] ioctl(3, LOOP_CLR_FD [pid 294] ioctl(3, LOOP_CLR_FD [pid 458] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 457] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 453] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 458] <... futex resumed>) = 0 [pid 457] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 453] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] getdents64(4, [pid 296] close(3 [pid 294] close(3 [pid 458] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 457] <... write resumed>) = 8 [pid 455] <... close resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 457] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(4 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 457] <... futex resumed>) = 1 [pid 453] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 457] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 453] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] rmdir("./4/file1" [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 462 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 463 [pid 457] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 453] <... futex resumed>) = 0 [pid 298] <... rmdir resumed>) = 0 [pid 457] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 453] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] getdents64(3, [pid 457] <... write resumed>) = 1045 [pid 455] mkdir("./bus", 0777 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 457] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 457] <... futex resumed>) = 1 [pid 453] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 457] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] rmdir("./4") = 0 [pid 298] mkdir("./5", 0777) = 0 ./strace-static-x86_64: Process 459 attached [pid 455] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 459] set_robust_list(0x7f0c4a20e9a0, 24 [pid 455] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 298] <... openat resumed>) = 3 [pid 459] <... set_robust_list resumed>) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 459] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 459] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] close(3 [pid 459] memfd_create("syzkaller", 0 [pid 298] <... close resumed>) = 0 [pid 459] <... memfd_create resumed>) = 3 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 459] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 464 [pid 459] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144./strace-static-x86_64: Process 463 attached [pid 463] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 463] chdir("./5") = 0 [pid 463] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 463] setpgid(0, 0) = 0 [pid 463] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 463] write(3, "1000", 4) = 4 [pid 459] <... write resumed>) = 262144 [pid 463] close(3 [pid 459] munmap(0x7f0c41dcd000, 138412032 [pid 463] <... close resumed>) = 0 [pid 459] <... munmap resumed>) = 0 [pid 463] symlink("/dev/binderfs", "./binderfs" [pid 459] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 463] <... symlink resumed>) = 0 [pid 459] <... openat resumed>) = 4 [pid 463] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 459] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 464 attached ./strace-static-x86_64: Process 461 attached [pid 463] <... futex resumed>) = 0 [pid 463] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 461] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 464] set_robust_list(0x555556d8d6a0, 24 [pid 463] <... rt_sigaction resumed>NULL, 8) = 0 [pid 463] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], ./strace-static-x86_64: Process 462 attached [pid 464] <... set_robust_list resumed>) = 0 [pid 463] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 461] <... set_robust_list resumed>) = 0 [pid 463] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 463] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 461] rt_sigprocmask(SIG_SETMASK, [], [pid 464] chdir("./5" [pid 463] <... mprotect resumed>) = 0 [pid 463] rt_sigprocmask(SIG_BLOCK, ~[], [pid 461] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 464] <... chdir resumed>) = 0 [pid 463] <... rt_sigprocmask resumed>[], 8) = 0 [pid 462] set_robust_list(0x555556d8d6a0, 24 [ 23.849994][ T454] loop1: detected capacity change from 0 to 512 [ 23.857551][ T455] loop3: detected capacity change from 0 to 512 [ 23.883270][ T455] EXT4-fs (loop3): Invalid log block size: 2475723007 [ 23.889476][ T459] loop5: detected capacity change from 0 to 512 [pid 463] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 464] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 463] <... clone3 resumed> => {parent_tid=[466]}, 88) = 466 [pid 462] <... set_robust_list resumed>) = 0 [pid 461] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 463] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 463] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 463] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 461] <... open resumed>) = 5 [pid 463] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 463] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 463] rt_sigprocmask(SIG_BLOCK, ~[], [pid 464] <... prctl resumed>) = 0 [pid 463] <... rt_sigprocmask resumed>[], 8) = 0 [pid 461] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] setpgid(0, 0 [pid 463] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 458] <... futex resumed>) = 0 [pid 461] <... futex resumed>) = 1 [pid 464] <... setpgid resumed>) = 0 [pid 462] chdir("./5" [pid 461] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 458] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 463] <... clone3 resumed> => {parent_tid=[467]}, 88) = 467 [pid 461] <... mount resumed>) = 0 [pid 458] <... futex resumed>) = 0 [pid 463] rt_sigprocmask(SIG_SETMASK, [], [pid 458] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 464] <... openat resumed>) = 3 [pid 463] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 462] <... chdir resumed>) = 0 [pid 461] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 463] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 466 attached [pid 463] <... futex resumed>) = 0 [pid 458] <... futex resumed>) = 0 [pid 466] set_robust_list(0x7f0c4a20e9a0, 24 [pid 463] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 458] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 466] <... set_robust_list resumed>) = 0 [pid 466] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 466] memfd_create("syzkaller", 0 [pid 464] write(3, "1000", 4 [pid 462] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 461] <... futex resumed>) = 1 [pid 458] <... futex resumed>) = 0 [pid 466] <... memfd_create resumed>) = 3 [pid 466] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 466] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 464] <... write resumed>) = 4 [pid 462] <... prctl resumed>) = 0 [pid 461] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 458] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=46000000} [pid 466] <... write resumed>) = 262144 [pid 464] close(3 [pid 462] setpgid(0, 0 [pid 464] <... close resumed>) = 0 [pid 462] <... setpgid resumed>) = 0 [pid 464] symlink("/dev/binderfs", "./binderfs" [pid 462] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 466] munmap(0x7f0c41dcd000, 138412032 [pid 464] <... symlink resumed>) = 0 [pid 462] <... openat resumed>) = 3 [pid 466] <... munmap resumed>) = 0 [pid 464] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 466] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 464] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 466] <... openat resumed>) = 4 [pid 464] <... rt_sigaction resumed>NULL, 8) = 0 [pid 462] write(3, "1000", 4 [pid 466] ioctl(4, LOOP_SET_FD, 3 [pid 464] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 462] <... write resumed>) = 4 ./strace-static-x86_64: Process 467 attached [pid 464] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 462] close(3 [pid 464] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 462] <... close resumed>) = 0 [pid 467] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 464] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 462] symlink("/dev/binderfs", "./binderfs" [pid 464] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 462] <... symlink resumed>) = 0 [pid 466] <... ioctl resumed>) = 0 [pid 467] <... set_robust_list resumed>) = 0 [pid 466] close(3 [pid 464] <... mprotect resumed>) = 0 [pid 462] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 461] <... open resumed>) = 6 [pid 459] <... ioctl resumed>) = 0 [pid 455] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 464] rt_sigprocmask(SIG_BLOCK, ~[], [pid 462] <... futex resumed>) = 0 [pid 461] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] <... rt_sigprocmask resumed>[], 8) = 0 [pid 462] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 461] <... futex resumed>) = 1 [pid 458] <... futex resumed>) = 0 [pid 467] rt_sigprocmask(SIG_SETMASK, [], [pid 455] ioctl(5, LOOP_CLR_FD [pid 464] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 462] <... rt_sigaction resumed>NULL, 8) = 0 [pid 461] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 458] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 461] <... write resumed>) = 8 [pid 458] <... futex resumed>) = 0 [pid 464] <... clone3 resumed> => {parent_tid=[468]}, 88) = 468 [pid 462] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 461] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 458] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 464] rt_sigprocmask(SIG_SETMASK, [], [pid 462] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 461] <... futex resumed>) = 0 [pid 458] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 464] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 462] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 461] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 458] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 461] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 458] <... futex resumed>) = 0 [pid 464] <... futex resumed>) = 0 [pid 462] <... mprotect resumed>) = 0 [pid 461] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 458] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 464] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] rt_sigprocmask(SIG_BLOCK, ~[], [pid 461] <... write resumed>) = 1045 [pid 464] <... futex resumed>) = 0 [pid 462] <... rt_sigprocmask resumed>[], 8) = 0 [pid 461] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 462] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 461] <... futex resumed>) = 1 [pid 458] <... futex resumed>) = 0 [pid 464] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 467] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 461] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 455] <... ioctl resumed>) = 0 [pid 459] close(3 [pid 466] <... close resumed>) = 0 [pid 467] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 464] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 462] <... clone3 resumed> => {parent_tid=[469]}, 88) = 469 [pid 455] close(5 [pid 459] <... close resumed>) = 0 [pid 466] mkdir("./bus", 0777 [pid 464] <... mprotect resumed>) = 0 [pid 462] rt_sigprocmask(SIG_SETMASK, [], [pid 464] rt_sigprocmask(SIG_BLOCK, ~[], [pid 462] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 464] <... rt_sigprocmask resumed>[], 8) = 0 [pid 462] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 469 attached ./strace-static-x86_64: Process 468 attached [pid 467] <... open resumed>) = 3 [pid 466] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 464] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 462] <... futex resumed>) = 0 [pid 459] mkdir("./bus", 0777 [pid 455] <... close resumed>) = 0 [pid 454] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 468] set_robust_list(0x7f0c4a20e9a0, 24 [pid 467] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 466] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 462] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 459] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 455] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 454] ioctl(6, LOOP_CLR_FD [pid 468] <... set_robust_list resumed>) = 0 [pid 467] <... futex resumed>) = 1 [pid 464] <... clone3 resumed> => {parent_tid=[470]}, 88) = 470 [pid 463] <... futex resumed>) = 0 [pid 462] <... futex resumed>) = 0 [ 23.901316][ T454] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 23.925618][ T466] loop0: detected capacity change from 0 to 512 [ 23.933056][ T454] EXT4-fs (loop1): get root inode failed [ 23.938884][ T454] EXT4-fs (loop1): mount failed [pid 459] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 455] <... futex resumed>) = 0 [pid 454] <... ioctl resumed>) = 0 [pid 453] exit_group(0./strace-static-x86_64: Process 470 attached [pid 469] set_robust_list(0x7f0c4a20e9a0, 24 [pid 468] rt_sigprocmask(SIG_SETMASK, [], [pid 467] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 464] rt_sigprocmask(SIG_SETMASK, [], [pid 463] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 457] <... futex resumed>) = ? [pid 453] <... exit_group resumed>) = ? [pid 470] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 464] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 462] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 457] +++ exited with 0 +++ [pid 470] <... set_robust_list resumed>) = 0 [pid 464] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 470] rt_sigprocmask(SIG_SETMASK, [], [pid 464] <... futex resumed>) = 0 [pid 462] <... mprotect resumed>) = 0 [pid 470] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 464] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 462] rt_sigprocmask(SIG_BLOCK, ~[], [pid 470] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 462] <... rt_sigprocmask resumed>[], 8) = 0 [pid 470] <... open resumed>) = 3 [pid 462] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 470] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 464] <... futex resumed>) = 0 [pid 462] <... clone3 resumed> => {parent_tid=[471]}, 88) = 471 [pid 470] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 464] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] rt_sigprocmask(SIG_SETMASK, [], [pid 470] <... mount resumed>) = 0 [pid 464] <... futex resumed>) = 0 [pid 462] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 470] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 462] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 470] <... futex resumed>) = 0 [pid 464] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 462] <... futex resumed>) = 0 [pid 470] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 464] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 470] <... open resumed>) = 4 [pid 464] <... futex resumed>) = 0 [pid 470] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 470] <... futex resumed>) = 0 [pid 464] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 470] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 464] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 470] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 464] <... futex resumed>) = 0 [pid 470] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 464] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 470] <... futex resumed>) = 0 [pid 464] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 470] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 464] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 470] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 464] <... futex resumed>) = 0 [pid 470] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 467] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 464] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 463] <... futex resumed>) = 0 [pid 454] close(6 [pid 470] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 468] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 467] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 470] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 464] <... futex resumed>) = 0 [pid 470] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 471 attached [pid 471] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 471] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 468] memfd_create("syzkaller", 0 [pid 467] <... mount resumed>) = 0 [pid 463] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 454] <... close resumed>) = 0 [pid 469] <... set_robust_list resumed>) = 0 [pid 467] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 468] <... memfd_create resumed>) = 5 [pid 463] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 454] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 469] rt_sigprocmask(SIG_SETMASK, [], [pid 468] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 467] <... futex resumed>) = 0 [pid 463] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 459] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 454] <... futex resumed>) = 0 [pid 471] <... open resumed>) = 3 [pid 469] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 468] <... mmap resumed>) = 0x7f0c41dcd000 [pid 467] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 463] <... futex resumed>) = 0 [pid 454] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 471] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 452] exit_group(0 [pid 471] <... futex resumed>) = 1 [pid 462] <... futex resumed>) = 0 [pid 456] <... futex resumed>) = ? [pid 452] <... exit_group resumed>) = ? [pid 471] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 462] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 456] +++ exited with 0 +++ [pid 471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 462] <... futex resumed>) = 0 [pid 471] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 462] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] <... mount resumed>) = 0 [pid 471] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 462] <... futex resumed>) = 0 [pid 471] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 462] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 462] <... futex resumed>) = 0 [pid 471] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 462] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 468] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 471] <... open resumed>) = 4 [pid 467] <... open resumed>) = 5 [pid 463] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 454] <... futex resumed>) = ? [pid 471] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 462] <... futex resumed>) = 0 [pid 471] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 462] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 462] <... futex resumed>) = 0 [pid 471] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 462] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 471] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 462] <... futex resumed>) = 0 [pid 471] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 462] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 471] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 462] <... futex resumed>) = 0 [pid 471] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 462] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 471] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 471] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 462] <... futex resumed>) = 0 [pid 471] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 467] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 463] <... futex resumed>) = 0 [pid 459] ioctl(4, LOOP_CLR_FD) = 0 [pid 459] close(4) = 0 [pid 459] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 459] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 469] memfd_create("syzkaller", 0) = 5 [pid 469] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 469] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 458] exit_group(0 [pid 469] <... write resumed>) = 262144 [pid 461] <... futex resumed>) = ? [pid 459] <... futex resumed>) = ? [pid 458] <... exit_group resumed>) = ? [pid 469] munmap(0x7f0c41dcd000, 138412032 [pid 461] +++ exited with 0 +++ [pid 459] +++ exited with 0 +++ [pid 469] <... munmap resumed>) = 0 [pid 469] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 467] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 463] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 468] <... write resumed>) = 262144 [pid 463] <... futex resumed>) = 0 [pid 469] <... openat resumed>) = 6 [pid 467] <... write resumed>) = 8 [pid 468] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 468] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 6 [pid 468] ioctl(6, LOOP_SET_FD, 5 [pid 469] ioctl(6, LOOP_SET_FD, 5 [pid 467] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 463] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 458] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=458, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 299] restart_syscall(<... resuming interrupted clone ...>) = 0 [pid 299] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 299] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 468] <... ioctl resumed>) = 0 [pid 468] close(5) = 0 [pid 468] mkdir("./file1", 0777) = 0 [ 23.952603][ T459] EXT4-fs (loop5): Invalid log block size: 2475723007 [ 23.967619][ T466] EXT4-fs (loop0): 1 orphan inode deleted [ 23.974677][ T466] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 23.977193][ T468] loop4: detected capacity change from 0 to 512 [ 23.985912][ T466] ext4 filesystem being mounted at /root/syzkaller.iF59aB/5/bus supports timestamps until 2038 (0x7fffffff) [pid 468] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 467] <... futex resumed>) = 0 [pid 463] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] <... umount2 resumed>) = 0 [pid 467] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 463] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 455] +++ exited with 0 +++ [pid 454] +++ exited with 0 +++ [pid 453] +++ exited with 0 +++ [pid 452] +++ exited with 0 +++ [pid 467] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 463] <... futex resumed>) = 0 [pid 467] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 463] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 467] <... write resumed>) = 1045 [pid 467] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 463] <... futex resumed>) = 0 [pid 467] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 469] <... ioctl resumed>) = 0 [pid 469] close(5) = 0 [pid 469] mkdir("./file1", 0777) = 0 [pid 469] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=453, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=452, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 466] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 466] ioctl(4, LOOP_CLR_FD) = 0 [pid 466] close(4 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 466] <... close resumed>) = 0 [pid 466] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 466] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 463] exit_group(0 [pid 299] newfstatat(AT_FDCWD, "./5/bus", [pid 467] <... futex resumed>) = ? [pid 466] <... futex resumed>) = ? [pid 463] <... exit_group resumed>) = ? [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./4", MNT_DETACH|UMOUNT_NOFOLLOW [pid 467] +++ exited with 0 +++ [pid 466] +++ exited with 0 +++ [pid 299] unlink("./5/bus" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... unlink resumed>) = 0 [pid 297] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] openat(AT_FDCWD, "./4", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(3, "", [pid 299] newfstatat(AT_FDCWD, "./5/binderfs", [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] newfstatat(3, "", [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./5/binderfs" [pid 297] getdents64(3, [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] <... unlink resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] getdents64(3, [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 299] close(3 [pid 295] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 297] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = 0 [pid 299] rmdir("./5" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./4/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... rmdir resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./5/bus", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] mkdir("./6", 0777 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] newfstatat(AT_FDCWD, "./4/bus", [pid 299] <... mkdir resumed>) = 0 [pid 297] unlink("./5/bus" [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] <... unlink resumed>) = 0 [pid 295] unlink("./4/bus" [pid 299] <... openat resumed>) = 3 [pid 297] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... unlink resumed>) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] umount2("./4/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] newfstatat(AT_FDCWD, "./5/binderfs", [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] close(3 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] newfstatat(AT_FDCWD, "./4/binderfs", [pid 299] <... close resumed>) = 0 [pid 297] unlink("./5/binderfs" [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... unlink resumed>) = 0 [ 24.003169][ T469] loop2: detected capacity change from 0 to 512 [ 24.028398][ T468] EXT4-fs (loop4): 1 orphan inode deleted [ 24.034222][ T468] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.036801][ T469] EXT4-fs (loop2): 1 orphan inode deleted [pid 295] unlink("./4/binderfs"./strace-static-x86_64: Process 478 attached [pid 468] <... mount resumed>) = 0 [pid 297] getdents64(3, [pid 295] <... unlink resumed>) = 0 [pid 478] set_robust_list(0x555556d8d6a0, 24 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 478 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] getdents64(3, [pid 478] <... set_robust_list resumed>) = 0 [pid 297] close(3 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 478] chdir("./6" [pid 297] <... close resumed>) = 0 [pid 295] close(3 [pid 478] <... chdir resumed>) = 0 [pid 297] rmdir("./5" [pid 295] <... close resumed>) = 0 [pid 478] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 297] <... rmdir resumed>) = 0 [pid 295] rmdir("./4" [pid 478] <... prctl resumed>) = 0 [pid 297] mkdir("./6", 0777 [pid 295] <... rmdir resumed>) = 0 [pid 478] setpgid(0, 0 [pid 297] <... mkdir resumed>) = 0 [pid 295] mkdir("./5", 0777 [pid 478] <... setpgid resumed>) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 295] <... mkdir resumed>) = 0 [pid 478] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] <... openat resumed>) = 3 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 478] <... openat resumed>) = 3 [pid 297] ioctl(3, LOOP_CLR_FD [pid 295] <... openat resumed>) = 3 [pid 478] write(3, "1000", 4 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] ioctl(3, LOOP_CLR_FD [pid 478] <... write resumed>) = 4 [pid 297] close(3 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 478] close(3 [pid 297] <... close resumed>) = 0 [pid 295] close(3 [pid 478] <... close resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... close resumed>) = 0 [pid 478] symlink("/dev/binderfs", "./binderfs" [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 478] <... symlink resumed>) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 479 [pid 478] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 480 [pid 478] <... futex resumed>) = 0 [pid 478] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 478] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 478] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 478] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 478] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 478] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[481]}, 88) = 481 [pid 478] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 478] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 478] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 478] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 478] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 478] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 478] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[482]}, 88) = 482 [pid 478] rt_sigprocmask(SIG_SETMASK, [], ./strace-static-x86_64: Process 482 attached ./strace-static-x86_64: Process 481 attached ./strace-static-x86_64: Process 480 attached ./strace-static-x86_64: Process 479 attached NULL, 8) = 0 [pid 469] <... mount resumed>) = 0 [pid 468] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 463] +++ exited with 0 +++ [pid 481] set_robust_list(0x7f0c4a20e9a0, 24 [pid 480] set_robust_list(0x555556d8d6a0, 24 [pid 479] set_robust_list(0x555556d8d6a0, 24 [pid 478] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 469] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 468] <... openat resumed>) = 5 [pid 481] <... set_robust_list resumed>) = 0 [pid 480] <... set_robust_list resumed>) = 0 [pid 479] <... set_robust_list resumed>) = 0 [pid 469] <... openat resumed>) = 5 [pid 468] chdir("./file1" [pid 481] rt_sigprocmask(SIG_SETMASK, [], [pid 480] chdir("./5" [pid 479] chdir("./6" [pid 469] chdir("./file1" [pid 468] <... chdir resumed>) = 0 [pid 481] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 480] <... chdir resumed>) = 0 [pid 479] <... chdir resumed>) = 0 [pid 469] <... chdir resumed>) = 0 [pid 468] ioctl(6, LOOP_CLR_FD [pid 482] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 481] memfd_create("syzkaller", 0 [pid 480] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 479] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 478] <... futex resumed>) = 0 [pid 469] ioctl(6, LOOP_CLR_FD [pid 468] <... ioctl resumed>) = 0 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=463, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 482] <... set_robust_list resumed>) = 0 [pid 481] <... memfd_create resumed>) = 3 [pid 480] <... prctl resumed>) = 0 [pid 479] <... prctl resumed>) = 0 [pid 478] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 469] <... ioctl resumed>) = 0 [pid 468] close(6 [pid 481] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 480] setpgid(0, 0 [pid 479] setpgid(0, 0 [pid 469] close(6 [pid 468] <... close resumed>) = 0 [pid 482] rt_sigprocmask(SIG_SETMASK, [], [pid 481] <... mmap resumed>) = 0x7f0c41dcd000 [pid 480] <... setpgid resumed>) = 0 [pid 479] <... setpgid resumed>) = 0 [pid 469] <... close resumed>) = 0 [pid 468] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 482] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 481] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 480] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 479] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 469] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 468] <... futex resumed>) = 0 [pid 482] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 481] <... write resumed>) = 262144 [pid 480] <... openat resumed>) = 3 [pid 479] <... openat resumed>) = 3 [pid 469] <... futex resumed>) = 0 [pid 468] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 482] <... open resumed>) = 4 [pid 481] munmap(0x7f0c41dcd000, 138412032 [pid 480] write(3, "1000", 4 [pid 479] write(3, "1000", 4 [pid 469] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 464] exit_group(0 [pid 462] exit_group(0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 482] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 481] <... munmap resumed>) = 0 [pid 480] <... write resumed>) = 4 [pid 479] <... write resumed>) = 4 [pid 471] <... futex resumed>) = ? [pid 470] <... futex resumed>) = ? [pid 469] <... futex resumed>) = ? [pid 468] <... futex resumed>) = ? [pid 464] <... exit_group resumed>) = ? [pid 462] <... exit_group resumed>) = ? [pid 294] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 482] <... futex resumed>) = 1 [pid 481] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 480] close(3 [pid 479] close(3 [pid 478] <... futex resumed>) = 0 [pid 471] +++ exited with 0 +++ [pid 470] +++ exited with 0 +++ [pid 469] +++ exited with 0 +++ [pid 468] +++ exited with 0 +++ [pid 481] <... openat resumed>) = 5 [pid 480] <... close resumed>) = 0 [ 24.045999][ T468] ext4 filesystem being mounted at /root/syzkaller.qPQybd/5/file1 supports timestamps until 2038 (0x7fffffff) [ 24.051245][ T469] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.075153][ T469] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/5/file1 supports timestamps until 2038 (0x7fffffff) [pid 479] <... close resumed>) = 0 [pid 464] +++ exited with 0 +++ [pid 481] ioctl(5, LOOP_SET_FD, 3 [pid 482] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 480] symlink("/dev/binderfs", "./binderfs" [pid 479] symlink("/dev/binderfs", "./binderfs" [pid 478] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 462] +++ exited with 0 +++ [pid 294] <... openat resumed>) = 3 [pid 482] <... mount resumed>) = 0 [pid 481] <... ioctl resumed>) = 0 [pid 480] <... symlink resumed>) = 0 [pid 479] <... symlink resumed>) = 0 [pid 478] <... futex resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=464, si_uid=0, si_status=0, si_utime=0, si_stime=6} --- [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=462, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 294] newfstatat(3, "", [pid 482] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 478] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 482] <... futex resumed>) = 0 [pid 480] <... futex resumed>) = 0 [pid 479] <... futex resumed>) = 0 [pid 478] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 482] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 480] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 479] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 478] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] getdents64(3, [pid 482] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 480] <... rt_sigaction resumed>NULL, 8) = 0 [pid 479] <... rt_sigaction resumed>NULL, 8) = 0 [pid 478] <... futex resumed>) = 0 [pid 298] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 482] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 480] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 479] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 478] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 482] <... open resumed>) = 6 [pid 480] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 479] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 482] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 479] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 482] <... futex resumed>) = 1 [pid 480] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 479] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 478] <... futex resumed>) = 0 [pid 298] newfstatat(3, "", [pid 296] newfstatat(3, "", [pid 294] <... umount2 resumed>) = 0 [pid 482] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 480] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 479] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 478] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 482] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 480] <... mprotect resumed>) = 0 [pid 479] <... mprotect resumed>) = 0 [pid 478] <... futex resumed>) = 0 [pid 298] getdents64(3, [pid 296] getdents64(3, [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 482] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 480] rt_sigprocmask(SIG_BLOCK, ~[], [pid 479] rt_sigprocmask(SIG_BLOCK, ~[], [pid 478] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 480] <... rt_sigprocmask resumed>[], 8) = 0 [pid 479] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] newfstatat(AT_FDCWD, "./5/bus", [pid 480] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 479] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 482] <... write resumed>) = 8 [pid 298] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 482] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... clone3 resumed> => {parent_tid=[483]}, 88) = 483 [pid 479] <... clone3 resumed> => {parent_tid=[484]}, 88) = 484 [pid 298] <... umount2 resumed>) = 0 [pid 482] <... futex resumed>) = 1 [pid 480] rt_sigprocmask(SIG_SETMASK, [], [pid 479] rt_sigprocmask(SIG_SETMASK, [], [pid 478] <... futex resumed>) = 0 [pid 298] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = 0 [pid 294] unlink("./5/bus" [pid 482] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 480] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 479] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 478] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 480] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 478] <... futex resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 482] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 480] <... futex resumed>) = 0 [pid 479] <... futex resumed>) = 0 [pid 478] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] newfstatat(AT_FDCWD, "./5/bus", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 482] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 480] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] newfstatat(AT_FDCWD, "./5/bus", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 480] <... futex resumed>) = 0 [pid 479] <... futex resumed>) = 0 [pid 298] unlink("./5/bus" [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 482] <... write resumed>) = 1045 [pid 480] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 479] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 294] newfstatat(AT_FDCWD, "./5/binderfs", [pid 482] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 479] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 298] <... unlink resumed>) = 0 [pid 296] unlink("./5/bus" [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 482] <... futex resumed>) = 1 [pid 480] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 479] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 478] <... futex resumed>) = 0 [pid 298] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 482] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 480] <... mprotect resumed>) = 0 [pid 479] <... mprotect resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] unlink("./5/binderfs" [pid 480] rt_sigprocmask(SIG_BLOCK, ~[], [pid 479] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] newfstatat(AT_FDCWD, "./5/binderfs", [pid 296] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 480] <... rt_sigprocmask resumed>[], 8) = 0 [pid 479] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... unlink resumed>) = 0 [pid 480] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 479] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 298] unlink("./5/binderfs" [pid 296] newfstatat(AT_FDCWD, "./5/binderfs", [pid 294] getdents64(3, [pid 480] <... clone3 resumed> => {parent_tid=[485]}, 88) = 485 [pid 479] <... clone3 resumed> => {parent_tid=[486]}, 88) = 486 [pid 480] rt_sigprocmask(SIG_SETMASK, [], [pid 479] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... unlink resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 480] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 479] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./5/binderfs" [pid 294] close(3 [pid 480] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... futex resumed>) = 0 [pid 479] <... futex resumed>) = 0 [pid 480] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 479] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 481] close(3) = 0 [pid 481] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 481] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 483 attached [pid 483] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 483] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 483] memfd_create("syzkaller", 0) = 3 [pid 483] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 296] <... unlink resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 294] rmdir("./5" [pid 483] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 294] <... rmdir resumed>) = 0 [pid 296] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] mkdir("./6", 0777 [pid 483] <... write resumed>) = 262144 [pid 483] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 483] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 294] <... mkdir resumed>) = 0 [pid 483] <... openat resumed>) = 4 [pid 483] ioctl(4, LOOP_SET_FD, 3 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 483] <... ioctl resumed>) = 0 [pid 483] close(3) = 0 [pid 483] mkdir("./file1", 0777) = 0 [pid 483] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 484 attached [pid 484] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 484] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 484] memfd_create("syzkaller", 0) = 3 [pid 484] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 484] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 484] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 484] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 484] ioctl(4, LOOP_SET_FD, 3 [pid 294] <... openat resumed>) = 3 [pid 294] ioctl(3, LOOP_CLR_FD./strace-static-x86_64: Process 485 attached [pid 485] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 485] <... set_robust_list resumed>) = 0 [pid 485] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 294] close(3) = 0 [pid 485] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 296] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 485] <... open resumed>) = 3 [pid 296] newfstatat(AT_FDCWD, "./5/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 488 [pid 296] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 485] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... futex resumed>) = 0 [pid 480] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 480] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 485] <... futex resumed>) = 1 [pid 485] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 485] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... futex resumed>) = 0 [pid 480] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 480] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 485] <... futex resumed>) = 1 [pid 485] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 485] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... futex resumed>) = 0 [pid 480] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 480] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 485] <... futex resumed>) = 1 [pid 485] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = 8 [pid 481] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 485] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 480] <... futex resumed>) = 0 [pid 480] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 480] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 485] <... futex resumed>) = 1 [pid 485] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 481] ioctl(5, LOOP_CLR_FD) = 0 [pid 296] <... openat resumed>) = 4 [pid 296] newfstatat(4, "", [pid 481] close(5 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 481] <... close resumed>) = 0 [pid 296] getdents64(4, [pid 485] <... write resumed>) = 1045 [pid 485] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 480] <... futex resumed>) = 0 [pid 296] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 481] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] close(4 [pid 485] <... futex resumed>) = 1 [pid 296] <... close resumed>) = 0 [pid 481] <... futex resumed>) = 0 [pid 296] rmdir("./5/file1" [pid 485] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 481] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... rmdir resumed>) = 0 [pid 478] exit_group(0 [pid 296] getdents64(3, [pid 482] <... futex resumed>) = ? [pid 478] <... exit_group resumed>) = ? [pid 482] +++ exited with 0 +++ [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] close(3 [pid 481] <... futex resumed>) = ? [ 24.110694][ T481] loop5: detected capacity change from 0 to 512 [ 24.131857][ T483] loop1: detected capacity change from 0 to 512 [ 24.138215][ T481] EXT4-fs (loop5): Invalid log block size: 2475723007 [ 24.143263][ T484] loop3: detected capacity change from 0 to 512 ./strace-static-x86_64: Process 488 attached ./strace-static-x86_64: Process 486 attached [pid 484] <... ioctl resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 296] rmdir("./5") = 0 [pid 296] mkdir("./6", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 486] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 486] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 486] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 5 [pid 486] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 486] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 488] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 488] chdir("./6") = 0 [pid 488] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 488] setpgid(0, 0) = 0 [pid 488] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 488] write(3, "1000", 4) = 4 [pid 488] close(3) = 0 [pid 488] symlink("/dev/binderfs", "./binderfs") = 0 [pid 488] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 488] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 488] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 488] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 488] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 488] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[490]}, 88) = 490 [pid 479] <... futex resumed>) = 0 ./strace-static-x86_64: Process 490 attached [pid 479] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 488] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 484] close(3 [pid 488] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 484] <... close resumed>) = 0 [pid 484] mkdir("./bus", 0777 [pid 488] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 484] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 488] <... mprotect resumed>) = 0 [pid 484] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 488] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 488] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[491]}, 88) = 491 [pid 488] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 488] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 488] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 490] set_robust_list(0x7f0c4a20e9a0, 24 [pid 486] <... futex resumed>) = 0 [pid 479] <... futex resumed>) = 1 [pid 490] <... set_robust_list resumed>) = 0 [pid 479] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 486] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL./strace-static-x86_64: Process 491 attached [pid 490] rt_sigprocmask(SIG_SETMASK, [], [pid 486] <... mount resumed>) = 0 [pid 491] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 491] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 491] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 491] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 488] <... futex resumed>) = 0 [pid 491] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 488] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... mount resumed>) = 0 [pid 488] <... futex resumed>) = 0 [pid 491] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 491] <... futex resumed>) = 0 [pid 488] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 491] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 488] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... open resumed>) = 4 [pid 488] <... futex resumed>) = 0 [pid 491] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 491] <... futex resumed>) = 0 [pid 488] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 491] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 488] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 488] <... futex resumed>) = 0 [pid 491] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 491] <... futex resumed>) = 0 [pid 488] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 491] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 490] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 488] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 486] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 490] memfd_create("syzkaller", 0 [pid 488] <... futex resumed>) = 0 [pid 486] <... futex resumed>) = 1 [pid 479] <... futex resumed>) = 0 [pid 491] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] <... memfd_create resumed>) = 5 [pid 488] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 486] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 483] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 479] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 491] <... futex resumed>) = 0 [pid 490] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 488] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 486] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 483] ioctl(4, LOOP_CLR_FD [pid 479] <... futex resumed>) = 0 [pid 491] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 490] <... mmap resumed>) = 0x7f0c41dcd000 [pid 486] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 483] <... ioctl resumed>) = 0 [pid 479] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 486] <... open resumed>) = 3 [pid 486] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 486] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 483] close(4) = 0 [pid 483] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 483] <... futex resumed>) = 0 [pid 479] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 483] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 480] exit_group(0 [pid 483] <... futex resumed>) = ? [pid 480] <... exit_group resumed>) = ? [pid 479] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] <... write resumed>) = 262144 [pid 485] <... futex resumed>) = ? [pid 483] +++ exited with 0 +++ [pid 479] <... futex resumed>) = 1 [pid 490] munmap(0x7f0c41dcd000, 138412032 [pid 486] <... futex resumed>) = 0 [pid 486] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 490] <... munmap resumed>) = 0 [pid 479] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 490] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 486] <... write resumed>) = 8 [pid 486] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] <... openat resumed>) = 6 [pid 486] <... futex resumed>) = 1 [pid 479] <... futex resumed>) = 0 [pid 490] ioctl(6, LOOP_SET_FD, 5 [pid 486] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 479] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 486] <... futex resumed>) = 0 [pid 479] <... futex resumed>) = 1 [pid 486] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 479] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 486] <... write resumed>) = 1045 [pid 486] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 479] <... futex resumed>) = 0 [pid 486] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 490] <... ioctl resumed>) = 0 [pid 481] +++ exited with 0 +++ [pid 478] +++ exited with 0 +++ [pid 490] close(5 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=478, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 490] <... close resumed>) = 0 [pid 490] mkdir("./file1", 0777) = 0 [pid 299] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 490] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [ 24.158956][ T483] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 24.172566][ T483] EXT4-fs (loop1): get root inode failed [ 24.179359][ T483] EXT4-fs (loop1): mount failed [ 24.191960][ T490] loop0: detected capacity change from 0 to 512 [pid 299] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 299] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./6/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 299] unlink("./6/bus" [pid 298] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] ioctl(3, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] newfstatat(AT_FDCWD, "./5/file1", [pid 296] close(3 [pid 299] <... unlink resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] <... close resumed>) = 0 [pid 298] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 494 [pid 298] <... openat resumed>) = 4 [pid 298] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 298] close(4) = 0 [pid 298] rmdir("./5/file1") = 0 [pid 298] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./5") = 0 [pid 298] mkdir("./6", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 495 [pid 299] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./6/binderfs") = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./6") = 0 [pid 299] mkdir("./7", 0777) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 496 ./strace-static-x86_64: Process 494 attached [pid 494] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 494] chdir("./6") = 0 [pid 494] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 494] setpgid(0, 0) = 0 [pid 494] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 494] write(3, "1000", 4) = 4 [pid 494] close(3) = 0 [pid 494] symlink("/dev/binderfs", "./binderfs") = 0 [pid 494] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 ./strace-static-x86_64: Process 495 attached [pid 494] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 494] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], ./strace-static-x86_64: Process 496 attached [pid 495] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 495] chdir("./6" [pid 494] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 494] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 495] <... chdir resumed>) = 0 [pid 494] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 494] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 495] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 495] setpgid(0, 0) = 0 [pid 495] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 495] write(3, "1000", 4) = 4 [pid 495] close(3) = 0 [pid 495] symlink("/dev/binderfs", "./binderfs") = 0 [pid 495] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 495] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 495] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 495] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 495] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 494] rt_sigprocmask(SIG_BLOCK, ~[], [pid 496] set_robust_list(0x555556d8d6a0, 24 [pid 494] <... rt_sigprocmask resumed>[], 8) = 0 [pid 496] <... set_robust_list resumed>) = 0 [pid 496] chdir("./7" [pid 494] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 496] <... chdir resumed>) = 0 [pid 496] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 494] <... clone3 resumed> => {parent_tid=[500]}, 88) = 500 [pid 496] <... prctl resumed>) = 0 [pid 494] rt_sigprocmask(SIG_SETMASK, [], [pid 496] setpgid(0, 0 [pid 495] <... mprotect resumed>) = 0 [pid 495] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 495] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[501]}, 88) = 501 [pid 495] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 495] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 495] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 495] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 495] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 495] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 495] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[502]}, 88) = 502 [pid 495] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 495] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 495] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 500 attached [pid 500] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 500] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 500] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 502 attached [pid 502] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 502] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 502] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 502] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] <... futex resumed>) = 0 [pid 495] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 495] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 502] <... futex resumed>) = 1 [pid 502] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 502] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 495] <... futex resumed>) = 0 [pid 495] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 495] <... futex resumed>) = 0 [pid 495] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 502] <... futex resumed>) = 1 [pid 502] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 494] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 485] +++ exited with 0 +++ [pid 480] +++ exited with 0 +++ ./strace-static-x86_64: Process 501 attached [pid 501] set_robust_list(0x7f0c4a20e9a0, 24 [pid 502] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 501] <... set_robust_list resumed>) = 0 [pid 495] <... futex resumed>) = 0 [pid 495] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 495] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 502] <... futex resumed>) = 1 [pid 501] rt_sigprocmask(SIG_SETMASK, [], [pid 502] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 501] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 502] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 501] memfd_create("syzkaller", 0 [pid 502] <... futex resumed>) = 1 [pid 495] <... futex resumed>) = 0 [pid 502] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 501] <... memfd_create resumed>) = 5 [pid 495] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 502] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 501] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 495] <... futex resumed>) = 0 [pid 502] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 501] <... mmap resumed>) = 0x7f0c41dcd000 [pid 495] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 502] <... futex resumed>) = 0 [pid 501] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 500] <... futex resumed>) = 0 [pid 495] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] <... futex resumed>) = 1 [pid 496] <... setpgid resumed>) = 0 [pid 502] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 500] memfd_create("syzkaller", 0 [pid 496] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 494] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 500] <... memfd_create resumed>) = 3 [pid 496] <... openat resumed>) = 3 [pid 494] <... futex resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=480, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 500] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 496] write(3, "1000", 4 [pid 494] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] restart_syscall(<... resuming interrupted clone ...> [pid 500] <... mmap resumed>) = 0x7f0c41dee000 [ 24.194263][ T484] EXT4-fs error (device loop3): ext4_map_blocks:602: inode #3: block 9: comm syz-executor170: lblock 0 mapped to illegal pblock 9 (length 1) [ 24.214915][ T484] EXT4-fs warning (device loop3): ext4_enable_quotas:6410: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [ 24.232876][ T490] EXT4-fs (loop0): 1 orphan inode deleted [ 24.240578][ T490] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 496] <... write resumed>) = 4 [pid 494] <... mmap resumed>) = 0x7f0c41dcd000 [pid 295] <... restart_syscall resumed>) = 0 [pid 501] <... write resumed>) = 262144 [pid 500] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 501] munmap(0x7f0c41dcd000, 138412032 [pid 500] <... write resumed>) = 262144 [pid 501] <... munmap resumed>) = 0 [pid 500] munmap(0x7f0c41dee000, 138412032 [pid 501] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 500] <... munmap resumed>) = 0 [pid 501] <... openat resumed>) = 6 [pid 500] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 501] ioctl(6, LOOP_SET_FD, 5 [pid 500] <... openat resumed>) = 4 [pid 500] ioctl(4, LOOP_SET_FD, 3 [pid 496] close(3 [pid 494] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 501] <... ioctl resumed>) = 0 [pid 496] <... close resumed>) = 0 [pid 494] <... mprotect resumed>) = 0 [pid 501] close(5 [pid 496] symlink("/dev/binderfs", "./binderfs" [pid 494] rt_sigprocmask(SIG_BLOCK, ~[], [pid 295] umount2("./5", MNT_DETACH|UMOUNT_NOFOLLOW [pid 501] <... close resumed>) = 0 [pid 496] <... symlink resumed>) = 0 [pid 494] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 501] mkdir("./file1", 0777 [pid 496] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 295] openat(AT_FDCWD, "./5", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 501] <... mkdir resumed>) = 0 [pid 496] <... futex resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 501] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 496] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 494] <... clone3 resumed> => {parent_tid=[503]}, 88) = 503 [pid 295] newfstatat(3, "", [pid 496] <... rt_sigaction resumed>NULL, 8) = 0 [pid 494] rt_sigprocmask(SIG_SETMASK, [], [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 496] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 494] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] getdents64(3, [pid 496] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 494] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 496] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 494] <... futex resumed>) = 0 [pid 295] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 496] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 494] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 496] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 496] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 496] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[504]}, 88) = 504 [pid 496] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 496] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 496] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 496] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 496] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 496] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 496] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[505]}, 88) = 505 [pid 496] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 496] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 496] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 505 attached ./strace-static-x86_64: Process 504 attached ./strace-static-x86_64: Process 503 attached [pid 500] <... ioctl resumed>) = 0 [pid 490] <... mount resumed>) = 0 [pid 484] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 295] <... umount2 resumed>) = 0 [pid 505] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 504] set_robust_list(0x7f0c4a20e9a0, 24 [pid 503] set_robust_list(0x7f0c41ded9a0, 24 [pid 500] close(3 [pid 490] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 484] ioctl(4, LOOP_CLR_FD [pid 505] <... set_robust_list resumed>) = 0 [pid 503] <... set_robust_list resumed>) = 0 [pid 500] <... close resumed>) = 0 [pid 490] <... openat resumed>) = 5 [pid 484] <... ioctl resumed>) = 0 [pid 505] rt_sigprocmask(SIG_SETMASK, [], [pid 504] <... set_robust_list resumed>) = 0 [pid 503] rt_sigprocmask(SIG_SETMASK, [], [pid 500] mkdir("./file1", 0777 [pid 490] chdir("./file1" [pid 484] close(4 [pid 295] umount2("./5/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 505] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 504] rt_sigprocmask(SIG_SETMASK, [], [pid 503] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 484] <... close resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 504] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] newfstatat(AT_FDCWD, "./5/bus", [pid 504] memfd_create("syzkaller", 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 504] <... memfd_create resumed>) = 3 [pid 295] unlink("./5/bus" [pid 504] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 295] <... unlink resumed>) = 0 [pid 504] <... mmap resumed>) = 0x7f0c41dcd000 [pid 295] umount2("./5/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 505] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 504] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 503] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 500] <... mkdir resumed>) = 0 [pid 490] <... chdir resumed>) = 0 [pid 484] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] <... open resumed>) = 4 [pid 503] <... open resumed>) = 3 [pid 500] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 490] ioctl(6, LOOP_CLR_FD [pid 484] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 505] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 504] <... write resumed>) = 262144 [pid 503] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] newfstatat(AT_FDCWD, "./5/binderfs", [pid 504] munmap(0x7f0c41dcd000, 138412032 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 505] <... futex resumed>) = 1 [pid 504] <... munmap resumed>) = 0 [pid 503] <... futex resumed>) = 1 [pid 484] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] unlink("./5/binderfs" [pid 505] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 504] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 503] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 496] <... futex resumed>) = 0 [pid 494] <... futex resumed>) = 0 [pid 490] <... ioctl resumed>) = 0 [pid 479] exit_group(0 [pid 295] <... unlink resumed>) = 0 [pid 504] <... openat resumed>) = 5 [pid 496] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] close(6 [pid 486] <... futex resumed>) = ? [pid 484] <... futex resumed>) = ? [pid 479] <... exit_group resumed>) = ? [pid 295] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 505] <... futex resumed>) = 0 [pid 504] ioctl(5, LOOP_SET_FD, 3 [pid 503] <... futex resumed>) = 0 [pid 496] <... futex resumed>) = 1 [pid 494] <... futex resumed>) = 1 [pid 490] <... close resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 505] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 503] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 496] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 494] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 490] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 486] +++ exited with 0 +++ [pid 484] +++ exited with 0 +++ [pid 295] newfstatat(AT_FDCWD, "./5/file1", [pid 505] <... mount resumed>) = 0 [pid 503] <... mount resumed>) = 0 [pid 490] <... futex resumed>) = 0 [pid 503] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 490] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 503] <... futex resumed>) = 1 [pid 494] <... futex resumed>) = 0 [pid 503] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] <... futex resumed>) = 0 [pid 503] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 494] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 503] <... open resumed>) = 5 [pid 503] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 494] <... futex resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 505] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 488] exit_group(0 [pid 295] umount2("./5/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 505] <... futex resumed>) = 1 [pid 503] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 496] <... futex resumed>) = 0 [pid 494] <... futex resumed>) = 0 [pid 491] <... futex resumed>) = ? [pid 490] <... futex resumed>) = ? [pid 488] <... exit_group resumed>) = ? [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 505] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 503] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 496] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 491] +++ exited with 0 +++ [pid 295] openat(AT_FDCWD, "./5/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 496] <... futex resumed>) = 0 [pid 490] +++ exited with 0 +++ [pid 488] +++ exited with 0 +++ [pid 505] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] <... openat resumed>) = 4 [pid 505] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 503] <... write resumed>) = 8 [pid 496] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] newfstatat(4, "", [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=488, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [ 24.279030][ T484] EXT4-fs (loop3): mount failed [ 24.284852][ T501] loop4: detected capacity change from 0 to 512 [ 24.288734][ T490] ext4 filesystem being mounted at /root/syzkaller.iF59aB/6/file1 supports timestamps until 2038 (0x7fffffff) [ 24.291678][ T500] loop2: detected capacity change from 0 to 512 [ 24.322566][ T504] loop5: detected capacity change from 0 to 512 [pid 503] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 503] <... futex resumed>) = 1 [pid 494] <... futex resumed>) = 0 [pid 294] <... restart_syscall resumed>) = 0 [pid 503] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 494] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 503] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 494] <... futex resumed>) = 0 [pid 503] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 494] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 294] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 504] <... ioctl resumed>) = 0 [pid 504] close(3) = 0 [pid 504] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 504] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 295] getdents64(4, [pid 294] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 505] <... open resumed>) = 6 [pid 503] <... write resumed>) = 1045 [pid 295] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 505] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 505] <... futex resumed>) = 1 [pid 503] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 496] <... futex resumed>) = 0 [pid 295] getdents64(4, [pid 294] newfstatat(AT_FDCWD, "./6/bus", [pid 505] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 503] <... futex resumed>) = 1 [pid 496] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 494] <... futex resumed>) = 0 [pid 505] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 503] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 496] <... futex resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 505] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 496] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] close(4) = 0 [pid 295] rmdir("./5/file1") = 0 [pid 295] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./5") = 0 [pid 295] mkdir("./6", 0777) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 510 [pid 294] unlink("./6/bus") = 0 [pid 294] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./6/binderfs") = 0 [pid 294] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 510 attached [pid 505] <... write resumed>) = 8 [ 24.336032][ T501] EXT4-fs (loop4): 1 orphan inode deleted [ 24.343554][ T501] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.354059][ T500] EXT4-fs error (device loop2): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 24.357373][ T504] EXT4-fs (loop5): 1 orphan inode deleted [ 24.369127][ T501] ext4 filesystem being mounted at /root/syzkaller.qPQybd/6/file1 supports timestamps until 2038 (0x7fffffff) [pid 505] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 479] +++ exited with 0 +++ [pid 505] <... futex resumed>) = 1 [pid 496] <... futex resumed>) = 0 [pid 496] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 496] <... futex resumed>) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=479, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 505] <... write resumed>) = 1045 [pid 496] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 510] set_robust_list(0x555556d8d6a0, 24 [pid 297] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 505] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 496] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 505] <... futex resumed>) = 0 [pid 510] <... set_robust_list resumed>) = 0 [pid 505] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 510] chdir("./6" [pid 297] newfstatat(3, "", [pid 510] <... chdir resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 510] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 297] getdents64(3, [pid 510] <... prctl resumed>) = 0 [pid 510] setpgid(0, 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 510] <... setpgid resumed>) = 0 [pid 297] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 297] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 510] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 297] newfstatat(AT_FDCWD, "./6/bus", [pid 510] <... openat resumed>) = 3 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 510] write(3, "1000", 4 [pid 297] unlink("./6/bus" [pid 510] <... write resumed>) = 4 [pid 510] close(3 [pid 297] <... unlink resumed>) = 0 [pid 501] <... mount resumed>) = 0 [pid 501] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 501] chdir("./file1") = 0 [pid 501] ioctl(6, LOOP_CLR_FD) = 0 [pid 501] close(6) = 0 [pid 501] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 501] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 510] <... close resumed>) = 0 [pid 495] exit_group(0 [pid 297] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 510] symlink("/dev/binderfs", "./binderfs" [pid 495] <... exit_group resumed>) = ? [pid 297] newfstatat(AT_FDCWD, "./6/binderfs", [pid 510] <... symlink resumed>) = 0 [pid 502] <... futex resumed>) = ? [pid 500] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 510] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 502] +++ exited with 0 +++ [pid 500] ioctl(4, LOOP_CLR_FD [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 500] <... ioctl resumed>) = 0 [pid 500] close(4) = 0 [pid 500] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 500] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 501] <... futex resumed>) = ? [pid 501] +++ exited with 0 +++ [pid 495] +++ exited with 0 +++ [pid 510] <... futex resumed>) = 0 [pid 297] unlink("./6/binderfs" [pid 510] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=495, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 297] <... unlink resumed>) = 0 [pid 510] <... rt_sigaction resumed>NULL, 8) = 0 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 297] getdents64(3, [pid 510] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 494] exit_group(0 [pid 298] <... restart_syscall resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 494] <... exit_group resumed>) = ? [pid 510] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 503] <... futex resumed>) = ? [pid 500] <... futex resumed>) = ? [pid 297] close(3 [pid 510] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 503] +++ exited with 0 +++ [pid 297] <... close resumed>) = 0 [pid 510] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 298] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] rmdir("./6" [pid 510] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... rmdir resumed>) = 0 [pid 510] <... mprotect resumed>) = 0 [pid 298] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] mkdir("./7", 0777 [pid 510] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... openat resumed>) = 3 [pid 297] <... mkdir resumed>) = 0 [pid 510] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] newfstatat(3, "", [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 510] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] getdents64(3, [pid 297] <... openat resumed>) = 3 [pid 510] <... clone3 resumed> => {parent_tid=[513]}, 88) = 513 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 510] rt_sigprocmask(SIG_SETMASK, [], [pid 298] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] ioctl(3, LOOP_CLR_FD [pid 510] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 510] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 510] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 510] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(AT_FDCWD, "./6/bus", [pid 297] close(3 [pid 510] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... close resumed>) = 0 [pid 510] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] unlink("./6/bus" [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 510] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 298] <... unlink resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 510] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 298] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 514 [pid 510] <... mprotect resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 510] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] newfstatat(AT_FDCWD, "./6/binderfs", [pid 510] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 510] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 298] unlink("./6/binderfs") = 0 [pid 510] <... clone3 resumed> => {parent_tid=[515]}, 88) = 515 [pid 298] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 510] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 294] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 510] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 510] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] newfstatat(AT_FDCWD, "./6/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 294] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] close(4) = 0 [pid 294] rmdir("./6/file1") = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3./strace-static-x86_64: Process 515 attached ./strace-static-x86_64: Process 514 attached ./strace-static-x86_64: Process 513 attached [pid 504] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 294] <... close resumed>) = 0 [pid 514] set_robust_list(0x555556d8d6a0, 24 [pid 513] set_robust_list(0x7f0c4a20e9a0, 24 [pid 504] ioctl(5, LOOP_CLR_FD [pid 294] rmdir("./6" [pid 515] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 514] <... set_robust_list resumed>) = 0 [pid 513] <... set_robust_list resumed>) = 0 [pid 504] <... ioctl resumed>) = 0 [pid 500] +++ exited with 0 +++ [pid 494] +++ exited with 0 +++ [pid 294] <... rmdir resumed>) = 0 [pid 515] <... set_robust_list resumed>) = 0 [pid 514] chdir("./7" [pid 513] rt_sigprocmask(SIG_SETMASK, [], [pid 504] close(5 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=494, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 294] mkdir("./7", 0777 [pid 515] rt_sigprocmask(SIG_SETMASK, [], [pid 514] <... chdir resumed>) = 0 [pid 513] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 504] <... close resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 515] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 514] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 513] memfd_create("syzkaller", 0 [pid 504] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 515] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 514] <... prctl resumed>) = 0 [pid 513] <... memfd_create resumed>) = 3 [pid 504] <... futex resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 515] <... open resumed>) = 4 [pid 514] setpgid(0, 0 [pid 513] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 504] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] ioctl(3, LOOP_CLR_FD [pid 515] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] <... setpgid resumed>) = 0 [pid 513] <... mmap resumed>) = 0x7f0c41dcd000 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 515] <... futex resumed>) = 1 [pid 514] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 513] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 510] <... futex resumed>) = 0 [pid 496] exit_group(0 [pid 294] close(3 [pid 515] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 514] <... openat resumed>) = 3 [pid 513] <... write resumed>) = 262144 [pid 510] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 505] <... futex resumed>) = ? [pid 504] <... futex resumed>) = ? [pid 496] <... exit_group resumed>) = ? [pid 294] <... close resumed>) = 0 [pid 515] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 514] write(3, "1000", 4 [pid 513] munmap(0x7f0c41dcd000, 138412032 [pid 510] <... futex resumed>) = 0 [pid 505] +++ exited with 0 +++ [pid 504] +++ exited with 0 +++ [pid 510] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 515] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 514] <... write resumed>) = 4 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 516 attached [pid 515] <... mount resumed>) = 0 [pid 514] close(3 [pid 513] <... munmap resumed>) = 0 [pid 296] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 516] set_robust_list(0x555556d8d6a0, 24 [pid 515] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] <... close resumed>) = 0 [pid 513] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 296] <... openat resumed>) = 3 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 516 [pid 516] <... set_robust_list resumed>) = 0 [pid 515] <... futex resumed>) = 1 [pid 514] symlink("/dev/binderfs", "./binderfs" [pid 513] <... openat resumed>) = 5 [pid 510] <... futex resumed>) = 0 [pid 296] newfstatat(3, "", [pid 516] chdir("./7" [pid 515] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 514] <... symlink resumed>) = 0 [pid 513] ioctl(5, LOOP_SET_FD, 3 [pid 510] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 516] <... chdir resumed>) = 0 [pid 515] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 514] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] <... futex resumed>) = 0 [ 24.385018][ T500] EXT4-fs (loop2): get root inode failed [ 24.392735][ T500] EXT4-fs (loop2): mount failed [ 24.398987][ T504] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.411308][ T504] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/7/bus supports timestamps until 2038 (0x7fffffff) [pid 510] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 296] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 516] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 516] setpgid(0, 0) = 0 [pid 516] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 516] write(3, "1000", 4) = 4 [pid 516] close(3) = 0 [pid 516] symlink("/dev/binderfs", "./binderfs") = 0 [pid 516] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 516] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 516] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 516] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 296] <... umount2 resumed>) = 0 [pid 515] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 514] <... futex resumed>) = 0 [pid 513] <... ioctl resumed>) = 0 [pid 296] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 515] <... open resumed>) = 6 [pid 514] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 513] close(3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 515] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] <... rt_sigaction resumed>NULL, 8) = 0 [pid 513] <... close resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./6/bus", [pid 515] <... futex resumed>) = 1 [pid 514] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 510] <... futex resumed>) = 0 [pid 516] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 515] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 514] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 513] mkdir("./bus", 0777 [pid 510] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 516] <... mprotect resumed>) = 0 [pid 515] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 514] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 510] <... futex resumed>) = 0 [pid 296] unlink("./6/bus" [pid 516] rt_sigprocmask(SIG_BLOCK, ~[], [pid 515] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 514] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 513] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 510] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 516] <... rt_sigprocmask resumed>[], 8) = 0 [pid 514] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 513] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 296] <... unlink resumed>) = 0 [pid 516] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 515] <... write resumed>) = 8 [pid 514] <... mprotect resumed>) = 0 [pid 296] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 515] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 517 attached [pid 516] <... clone3 resumed> => {parent_tid=[517]}, 88) = 517 [pid 515] <... futex resumed>) = 1 [pid 514] <... rt_sigprocmask resumed>[], 8) = 0 [pid 510] <... futex resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./6/binderfs", [pid 517] set_robust_list(0x7f0c4a20e9a0, 24 [pid 516] rt_sigprocmask(SIG_SETMASK, [], [pid 515] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 514] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 510] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 517] <... set_robust_list resumed>) = 0 [pid 516] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 515] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 510] <... futex resumed>) = 0 [pid 296] unlink("./6/binderfs"./strace-static-x86_64: Process 518 attached [pid 517] rt_sigprocmask(SIG_SETMASK, [], [pid 516] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 514] <... clone3 resumed> => {parent_tid=[518]}, 88) = 518 [pid 510] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... unlink resumed>) = 0 [pid 518] set_robust_list(0x7f0c4a20e9a0, 24 [pid 517] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 516] <... futex resumed>) = 0 [pid 515] <... write resumed>) = 1045 [pid 514] rt_sigprocmask(SIG_SETMASK, [], [pid 296] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 518] <... set_robust_list resumed>) = 0 [pid 517] memfd_create("syzkaller", 0 [pid 516] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 515] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 518] rt_sigprocmask(SIG_SETMASK, [], [pid 517] <... memfd_create resumed>) = 3 [pid 516] <... futex resumed>) = 0 [pid 515] <... futex resumed>) = 1 [pid 514] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 510] <... futex resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./6/file1", [pid 518] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 517] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 516] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 515] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 514] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 518] memfd_create("syzkaller", 0 [pid 517] <... mmap resumed>) = 0x7f0c41dee000 [pid 516] <... mmap resumed>) = 0x7f0c41dcd000 [pid 514] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 518] <... memfd_create resumed>) = 3 [pid 517] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 516] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 514] <... futex resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 518] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 517] <... write resumed>) = 262144 [pid 516] <... mprotect resumed>) = 0 [pid 514] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 518] <... mmap resumed>) = 0x7f0c41dee000 [pid 517] munmap(0x7f0c41dee000, 138412032 [pid 516] rt_sigprocmask(SIG_BLOCK, ~[], [pid 514] <... mmap resumed>) = 0x7f0c41dcd000 [pid 296] <... openat resumed>) = 4 [pid 296] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] close(4) = 0 [pid 296] rmdir("./6/file1") = 0 [pid 296] getdents64(3, [pid 517] <... munmap resumed>) = 0 [pid 516] <... rt_sigprocmask resumed>[], 8) = 0 [pid 514] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 517] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 516] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 514] <... mprotect resumed>) = 0 [pid 296] close(3 [pid 518] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 517] <... openat resumed>) = 4 [pid 514] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] <... close resumed>) = 0 [pid 517] ioctl(4, LOOP_SET_FD, 3 [pid 516] <... clone3 resumed> => {parent_tid=[521]}, 88) = 521 [pid 514] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] rmdir("./6"./strace-static-x86_64: Process 521 attached [pid 518] <... write resumed>) = 262144 [pid 516] rt_sigprocmask(SIG_SETMASK, [], [pid 514] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 496] +++ exited with 0 +++ [pid 298] <... umount2 resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 521] set_robust_list(0x7f0c41ded9a0, 24 [pid 518] munmap(0x7f0c41dee000, 138412032 [pid 298] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 521] <... set_robust_list resumed>) = 0 [pid 518] <... munmap resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 521] rt_sigprocmask(SIG_SETMASK, [], [pid 518] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 298] newfstatat(AT_FDCWD, "./6/file1", [pid 521] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 518] <... openat resumed>) = 4 [pid 516] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] mkdir("./7", 0777 [pid 521] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [ 24.452726][ T513] loop1: detected capacity change from 0 to 512 [ 24.469212][ T513] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 24.483947][ T513] EXT4-fs (loop1): get root inode failed [ 24.485843][ T517] loop0: detected capacity change from 0 to 512 [ 24.492909][ T513] EXT4-fs (loop1): mount failed [pid 518] ioctl(4, LOOP_SET_FD, 3 [pid 298] umount2("./6/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 517] <... ioctl resumed>) = 0 [pid 516] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] <... clone3 resumed> => {parent_tid=[522]}, 88) = 522 [pid 513] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=496, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... mkdir resumed>) = 0 [pid 518] <... ioctl resumed>) = 0 [pid 513] ioctl(5, LOOP_CLR_FD [pid 298] openat(AT_FDCWD, "./6/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 518] close(3 [pid 513] <... ioctl resumed>) = 0 [pid 298] <... openat resumed>) = 4 [pid 521] <... futex resumed>) = 0 [pid 516] <... futex resumed>) = 1 [pid 514] rt_sigprocmask(SIG_SETMASK, [], [pid 521] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 518] <... close resumed>) = 0 [pid 513] close(5 [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 298] newfstatat(4, "", [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 521] <... open resumed>) = 5 [pid 518] mkdir("./file1", 0777 [pid 516] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 514] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 513] <... close resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 ./strace-static-x86_64: Process 522 attached [pid 521] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 518] <... mkdir resumed>) = 0 [pid 517] close(3 [pid 516] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 514] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 513] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... restart_syscall resumed>) = 0 [pid 298] getdents64(4, [pid 296] <... openat resumed>) = 3 [pid 522] set_robust_list(0x7f0c41ded9a0, 24 [pid 521] <... futex resumed>) = 0 [pid 518] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 513] <... futex resumed>) = 0 [pid 517] <... close resumed>) = 0 [pid 516] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] <... futex resumed>) = 0 [pid 510] exit_group(0 [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] ioctl(3, LOOP_CLR_FD [pid 522] <... set_robust_list resumed>) = 0 [pid 521] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 513] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] getdents64(4, [pid 522] rt_sigprocmask(SIG_SETMASK, [], [pid 521] <... mount resumed>) = 0 [pid 517] mkdir("./bus", 0777 [pid 516] <... futex resumed>) = 0 [pid 515] <... futex resumed>) = ? [pid 514] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 513] +++ exited with 0 +++ [pid 510] <... exit_group resumed>) = ? [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 522] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 521] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(4 [pid 522] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 521] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 522] <... open resumed>) = 3 [pid 521] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 515] +++ exited with 0 +++ [pid 298] rmdir("./6/file1" [pid 522] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... rmdir resumed>) = 0 [pid 296] close(3 [pid 522] <... futex resumed>) = 1 [pid 516] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 514] <... futex resumed>) = 0 [pid 299] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] getdents64(3, [pid 522] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 514] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 522] <... mount resumed>) = 0 [pid 514] <... futex resumed>) = 0 [pid 298] close(3 [pid 522] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... close resumed>) = 0 [pid 522] <... futex resumed>) = 0 [pid 514] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] rmdir("./6" [pid 522] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 517] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 516] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] <... rmdir resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 522] <... open resumed>) = 5 [pid 521] <... futex resumed>) = 0 [pid 517] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 516] <... futex resumed>) = 1 [pid 514] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] mkdir("./7", 0777 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 522] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 516] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 514] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... openat resumed>) = 3 [pid 298] <... mkdir resumed>) = 0 [pid 522] <... futex resumed>) = 0 [pid 521] <... open resumed>) = 3 [pid 514] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 522] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 521] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(3, "", [pid 298] <... openat resumed>) = 3 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 523 [pid 522] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 521] <... futex resumed>) = 1 [pid 516] <... futex resumed>) = 0 [pid 514] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 522] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 521] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] getdents64(3, [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 522] <... write resumed>) = 8 [pid 521] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 516] <... futex resumed>) = 0 [pid 298] close(3 [pid 522] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 516] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] <... close resumed>) = 0 [pid 522] <... futex resumed>) = 1 [pid 521] <... write resumed>) = 8 [pid 514] <... futex resumed>) = 0 [pid 299] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 522] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 521] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = 0 ./strace-static-x86_64: Process 523 attached [pid 522] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 521] <... futex resumed>) = 1 [pid 516] <... futex resumed>) = 0 [pid 514] <... futex resumed>) = 0 [pid 299] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 525 [pid 523] set_robust_list(0x555556d8d6a0, 24 [pid 522] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 521] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 514] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 523] <... set_robust_list resumed>) = 0 [pid 522] <... write resumed>) = 1045 [pid 521] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 516] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./7/bus", [pid 523] chdir("./7" [pid 522] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 521] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 516] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 523] <... chdir resumed>) = 0 [pid 522] <... futex resumed>) = 1 [pid 521] <... write resumed>) = 1045 [pid 514] <... futex resumed>) = 0 [pid 299] unlink("./7/bus" [pid 523] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 522] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 521] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 523] <... prctl resumed>) = 0 [pid 521] <... futex resumed>) = 1 [pid 299] <... unlink resumed>) = 0 [pid 523] setpgid(0, 0 [pid 521] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 516] <... futex resumed>) = 0 [pid 299] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 523] <... setpgid resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 523] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 299] newfstatat(AT_FDCWD, "./7/binderfs", [pid 523] <... openat resumed>) = 3 [pid 523] write(3, "1000", 4) = 4 [pid 523] close(3) = 0 [pid 523] symlink("/dev/binderfs", "./binderfs") = 0 [pid 523] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 523] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 523] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 523] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 523] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 523] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 523] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 525 attached [pid 523] <... clone3 resumed> => {parent_tid=[526]}, 88) = 526 [pid 299] unlink("./7/binderfs" [pid 525] set_robust_list(0x555556d8d6a0, 24 [pid 523] rt_sigprocmask(SIG_SETMASK, [], [pid 525] <... set_robust_list resumed>) = 0 [pid 523] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 525] chdir("./7" [pid 523] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] <... chdir resumed>) = 0 [pid 523] <... futex resumed>) = 0 [pid 525] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 523] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] <... prctl resumed>) = 0 [pid 523] <... futex resumed>) = 0 [pid 525] setpgid(0, 0 [pid 523] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 525] <... setpgid resumed>) = 0 [pid 523] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 525] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 523] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 525] <... openat resumed>) = 3 [pid 523] <... mprotect resumed>) = 0 [pid 299] <... unlink resumed>) = 0 [pid 525] write(3, "1000", 4 [pid 523] rt_sigprocmask(SIG_BLOCK, ~[], [pid 525] <... write resumed>) = 4 [pid 523] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] getdents64(3, [pid 525] close(3 [pid 523] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 525] <... close resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 525] symlink("/dev/binderfs", "./binderfs" [pid 523] <... clone3 resumed> => {parent_tid=[527]}, 88) = 527 [pid 525] <... symlink resumed>) = 0 [pid 523] rt_sigprocmask(SIG_SETMASK, [], [pid 299] close(3 [pid 525] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 523] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... close resumed>) = 0 [pid 525] <... futex resumed>) = 0 [pid 523] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] rmdir("./7" [pid 525] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 523] <... futex resumed>) = 0 [pid 525] <... rt_sigaction resumed>NULL, 8) = 0 [pid 523] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 525] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 299] <... rmdir resumed>) = 0 [pid 299] mkdir("./8", 0777 [pid 525] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 525] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 525] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 525] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... mkdir resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 525] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] <... openat resumed>) = 3 [pid 525] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 299] ioctl(3, LOOP_CLR_FD./strace-static-x86_64: Process 526 attached ) = -1 ENXIO (No such device or address) [pid 526] set_robust_list(0x7f0c4a20e9a0, 24 [pid 525] <... clone3 resumed> => {parent_tid=[529]}, 88) = 529 [pid 526] <... set_robust_list resumed>) = 0 [pid 525] rt_sigprocmask(SIG_SETMASK, [], [pid 526] rt_sigprocmask(SIG_SETMASK, [], [pid 525] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 526] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 525] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] close(3 [pid 526] memfd_create("syzkaller", 0 [pid 525] <... futex resumed>) = 0 [pid 299] <... close resumed>) = 0 [ 24.505345][ T518] loop3: detected capacity change from 0 to 512 ./strace-static-x86_64: Process 529 attached ./strace-static-x86_64: Process 527 attached [pid 526] <... memfd_create resumed>) = 3 [pid 525] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 510] +++ exited with 0 +++ [pid 529] set_robust_list(0x7f0c4a20e9a0, 24 [pid 527] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=510, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 529] <... set_robust_list resumed>) = 0 [pid 527] <... set_robust_list resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 532 [pid 529] rt_sigprocmask(SIG_SETMASK, [], [pid 527] rt_sigprocmask(SIG_SETMASK, [], [pid 529] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 527] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 526] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 525] <... futex resumed>) = 0 [pid 529] memfd_create("syzkaller", 0 [pid 527] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 525] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 529] <... memfd_create resumed>) = 3 [pid 527] <... open resumed>) = 4 [pid 526] <... mmap resumed>) = 0x7f0c41dcd000 [pid 529] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 527] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] <... mmap resumed>) = 0x7f0c41dee000 [pid 527] <... futex resumed>) = 1 [pid 523] <... futex resumed>) = 0 [pid 295] umount2("./6", MNT_DETACH|UMOUNT_NOFOLLOW [pid 529] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 527] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 526] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 525] <... mmap resumed>) = 0x7f0c41dcd000 [pid 523] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 529] <... write resumed>) = 262144 [pid 527] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 525] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 523] <... futex resumed>) = 0 [pid 295] openat(AT_FDCWD, "./6", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 529] munmap(0x7f0c41dee000, 138412032 [pid 527] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 525] <... mprotect resumed>) = 0 [pid 523] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... openat resumed>) = 3 [pid 529] <... munmap resumed>) = 0 [pid 527] <... mount resumed>) = 0 [pid 526] <... write resumed>) = 262144 [pid 525] rt_sigprocmask(SIG_BLOCK, ~[], [pid 295] newfstatat(3, "", [pid 529] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 527] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 526] munmap(0x7f0c41dcd000, 138412032 [pid 525] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 529] <... openat resumed>) = 4 [pid 527] <... futex resumed>) = 1 [pid 525] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 523] <... futex resumed>) = 0 [pid 295] getdents64(3, [pid 529] ioctl(4, LOOP_SET_FD, 3 [pid 527] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 526] <... munmap resumed>) = 0 [pid 523] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 ./strace-static-x86_64: Process 532 attached [pid 529] <... ioctl resumed>) = 0 [pid 527] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 523] <... futex resumed>) = 0 [pid 295] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 527] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 523] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] <... open resumed>) = 5 [pid 527] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 523] <... futex resumed>) = 0 [pid 527] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 523] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 527] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 523] <... futex resumed>) = 0 [pid 527] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 523] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 527] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 523] <... futex resumed>) = 0 [pid 527] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 523] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 527] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 523] <... futex resumed>) = 0 [pid 527] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 523] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 533 attached [pid 532] set_robust_list(0x555556d8d6a0, 24 [pid 527] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 526] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 525] <... clone3 resumed> => {parent_tid=[533]}, 88) = 533 [pid 295] <... umount2 resumed>) = 0 [pid 533] set_robust_list(0x7f0c41ded9a0, 24 [pid 532] <... set_robust_list resumed>) = 0 [pid 527] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] umount2("./6/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 533] <... set_robust_list resumed>) = 0 [pid 527] <... futex resumed>) = 1 [pid 523] <... futex resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 533] rt_sigprocmask(SIG_SETMASK, [], [pid 527] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] newfstatat(AT_FDCWD, "./6/bus", [pid 533] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 533] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] unlink("./6/bus") = 0 [pid 295] umount2("./6/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./6/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./6/binderfs") = 0 [pid 529] close(3 [pid 295] getdents64(3, [pid 529] <... close resumed>) = 0 [ 24.543851][ T517] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 24.543878][ T518] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 24.589061][ T529] loop4: detected capacity change from 0 to 512 [ 24.591365][ T517] EXT4-fs (loop0): get root inode failed [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 532] chdir("./8" [pid 529] mkdir("./file1", 0777 [pid 526] <... openat resumed>) = 6 [pid 525] rt_sigprocmask(SIG_SETMASK, [], [pid 295] close(3 [pid 532] <... chdir resumed>) = 0 [pid 529] <... mkdir resumed>) = 0 [pid 526] ioctl(6, LOOP_SET_FD, 3 [pid 525] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] <... close resumed>) = 0 [pid 529] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 295] rmdir("./6") = 0 [pid 295] mkdir("./7", 0777) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 3 [pid 295] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 295] close(3) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 532] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 534 ./strace-static-x86_64: Process 534 attached [pid 534] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 534] chdir("./7") = 0 [pid 534] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 534] setpgid(0, 0) = 0 [pid 534] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 534] write(3, "1000", 4) = 4 [pid 534] close(3) = 0 [pid 534] symlink("/dev/binderfs", "./binderfs") = 0 [pid 534] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 525] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 534] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 534] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 534] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 534] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 534] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 534] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[535]}, 88) = 535 [pid 534] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 534] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 534] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 534] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 534] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 534] rt_sigprocmask(SIG_BLOCK, ~[], [pid 533] <... futex resumed>) = 0 [pid 532] <... prctl resumed>) = 0 [pid 525] <... futex resumed>) = 1 [pid 534] <... rt_sigprocmask resumed>[], 8) = 0 [pid 533] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 532] setpgid(0, 0 [pid 526] <... ioctl resumed>) = 0 [pid 525] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 534] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 533] <... open resumed>) = 3 [pid 533] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 534] <... clone3 resumed> => {parent_tid=[536]}, 88) = 536 [pid 533] <... futex resumed>) = 0 [pid 534] rt_sigprocmask(SIG_SETMASK, [], [pid 533] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 534] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 534] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 535 attached [pid 535] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 535] rt_sigprocmask(SIG_SETMASK, [], [pid 532] <... setpgid resumed>) = 0 [pid 525] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 532] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 526] close(3 [pid 525] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 517] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) ./strace-static-x86_64: Process 536 attached [pid 533] <... futex resumed>) = 0 [pid 532] <... openat resumed>) = 3 [pid 526] <... close resumed>) = 0 [pid 525] <... futex resumed>) = 1 [pid 517] ioctl(4, LOOP_CLR_FD [pid 533] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 532] write(3, "1000", 4 [pid 526] mkdir("./bus", 0777 [pid 525] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 535] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 533] <... mount resumed>) = 0 [pid 532] <... write resumed>) = 4 [pid 526] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 517] <... ioctl resumed>) = 0 [pid 535] memfd_create("syzkaller", 0 [pid 532] close(3 [pid 517] close(4 [pid 535] <... memfd_create resumed>) = 3 [pid 533] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 526] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 517] <... close resumed>) = 0 [pid 535] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 535] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 533] <... futex resumed>) = 1 [pid 532] <... close resumed>) = 0 [pid 525] <... futex resumed>) = 0 [pid 517] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 532] symlink("/dev/binderfs", "./binderfs" [pid 525] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 517] <... futex resumed>) = 0 [pid 516] exit_group(0) = ? [pid 535] <... write resumed>) = 262144 [pid 535] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 535] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 535] ioctl(4, LOOP_SET_FD, 3 [pid 536] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 536] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 536] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 525] <... futex resumed>) = 0 [pid 521] <... futex resumed>) = ? [pid 536] <... open resumed>) = 5 [pid 533] <... open resumed>) = 5 [pid 532] <... symlink resumed>) = 0 [ 24.601551][ T517] EXT4-fs (loop0): mount failed [ 24.607322][ T518] EXT4-fs (loop3): get root inode failed [ 24.613165][ T526] loop2: detected capacity change from 0 to 512 [ 24.628180][ T518] EXT4-fs (loop3): mount failed [ 24.639660][ T529] EXT4-fs (loop4): 1 orphan inode deleted [ 24.646146][ T535] loop1: detected capacity change from 0 to 512 [pid 536] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 534] <... futex resumed>) = 0 [pid 536] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 532] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 525] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 521] +++ exited with 0 +++ [pid 536] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 534] <... futex resumed>) = 0 [pid 536] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 534] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 536] <... mount resumed>) = 0 [pid 525] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 536] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 535] <... ioctl resumed>) = 0 [pid 533] <... futex resumed>) = 0 [pid 532] <... futex resumed>) = 0 [pid 525] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 536] <... futex resumed>) = 1 [pid 534] <... futex resumed>) = 0 [pid 536] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 536] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 534] <... futex resumed>) = 0 [pid 536] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 534] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 536] <... open resumed>) = 6 [pid 536] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 534] <... futex resumed>) = 0 [pid 536] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 536] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 534] <... futex resumed>) = 0 [pid 536] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 534] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 518] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 518] ioctl(4, LOOP_CLR_FD) = 0 [pid 518] close(4) = 0 [pid 518] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 518] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 535] close(3) = 0 [pid 535] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 535] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 533] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 532] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 532] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 532] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 532] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 532] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 532] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[540]}, 88) = 540 [pid 532] rt_sigprocmask(SIG_SETMASK, [], [pid 525] <... futex resumed>) = 0 [pid 514] exit_group(0 [pid 532] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 525] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 532] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 532] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 532] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 517] +++ exited with 0 +++ [pid 516] +++ exited with 0 +++ [pid 532] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=516, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 532] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 532] <... mprotect resumed>) = 0 [pid 294] <... restart_syscall resumed>) = 0 [pid 532] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 532] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 294] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 532] <... clone3 resumed> => {parent_tid=[542]}, 88) = 542 [pid 294] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 532] rt_sigprocmask(SIG_SETMASK, [], [pid 294] <... openat resumed>) = 3 [pid 532] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] newfstatat(3, "", [pid 532] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 532] <... futex resumed>) = 0 [pid 294] getdents64(3, [pid 532] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 522] <... futex resumed>) = ? [pid 518] <... futex resumed>) = ? [pid 514] <... exit_group resumed>) = ? [pid 294] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 522] +++ exited with 0 +++ [pid 518] +++ exited with 0 +++ [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./7/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 536] <... write resumed>) = 8 [pid 294] unlink("./7/bus"./strace-static-x86_64: Process 542 attached ./strace-static-x86_64: Process 540 attached [pid 536] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] <... write resumed>) = 8 [pid 529] <... mount resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 542] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 540] set_robust_list(0x7f0c4a20e9a0, 24 [pid 529] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 294] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 542] <... set_robust_list resumed>) = 0 [pid 540] <... set_robust_list resumed>) = 0 [pid 529] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 542] rt_sigprocmask(SIG_SETMASK, [], [pid 540] rt_sigprocmask(SIG_SETMASK, [], [pid 529] ioctl(4, LOOP_CLR_FD [pid 294] newfstatat(AT_FDCWD, "./7/binderfs", [pid 542] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 540] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 529] <... ioctl resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 542] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 540] memfd_create("syzkaller", 0 [pid 529] close(4 [pid 294] unlink("./7/binderfs" [pid 542] <... open resumed>) = 3 [pid 540] <... memfd_create resumed>) = 4 [pid 529] <... close resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 542] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 529] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] getdents64(3, [pid 542] <... futex resumed>) = 1 [pid 540] <... mmap resumed>) = 0x7f0c41dcd000 [pid 532] <... futex resumed>) = 0 [pid 529] <... futex resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 542] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 540] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 532] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] close(3 [pid 542] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 540] <... write resumed>) = 262144 [pid 536] <... futex resumed>) = 1 [pid 534] <... futex resumed>) = 0 [pid 533] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 532] <... futex resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 542] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 540] munmap(0x7f0c41dcd000, 138412032 [pid 532] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] rmdir("./7" [pid 542] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 540] <... munmap resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 542] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] openat(AT_FDCWD, "/dev/loop5", O_RDWR [ 24.651114][ T529] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.666118][ T529] ext4 filesystem being mounted at /root/syzkaller.qPQybd/7/file1 supports timestamps until 2038 (0x7fffffff) [ 24.690931][ T526] EXT4-fs (loop2): 1 orphan inode deleted [pid 294] mkdir("./8", 0777 [pid 542] <... futex resumed>) = 1 [pid 540] <... openat resumed>) = 5 [pid 532] <... futex resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 542] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 540] ioctl(5, LOOP_SET_FD, 4 [pid 532] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 542] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 540] <... ioctl resumed>) = 0 [pid 536] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 533] <... futex resumed>) = 1 [pid 532] <... futex resumed>) = 0 [pid 525] <... futex resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 542] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 540] close(4 [pid 532] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] ioctl(3, LOOP_CLR_FD [pid 542] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 540] <... close resumed>) = 0 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 542] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] mkdir("./file1", 0777 [pid 294] close(3 [pid 542] <... futex resumed>) = 1 [pid 540] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 532] <... futex resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 542] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 540] mount("/dev/loop5", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 532] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 542] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 532] <... futex resumed>) = 0 [pid 542] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 532] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 544 [pid 542] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 542] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 532] <... futex resumed>) = 0 [pid 542] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 532] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 542] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 532] <... futex resumed>) = 0 [pid 542] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 532] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 542] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 542] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 532] <... futex resumed>) = 0 [pid 542] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 536] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 534] <... futex resumed>) = 0 [pid 533] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 525] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 544 attached [pid 536] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 534] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 529] <... futex resumed>) = 0 [pid 525] <... futex resumed>) = 1 [pid 514] +++ exited with 0 +++ [pid 544] set_robust_list(0x555556d8d6a0, 24 [pid 536] <... write resumed>) = 1045 [pid 525] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 544] <... set_robust_list resumed>) = 0 [pid 544] chdir("./8") = 0 [pid 544] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 544] setpgid(0, 0) = 0 [pid 544] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 544] write(3, "1000", 4) = 4 [pid 544] close(3) = 0 [pid 544] symlink("/dev/binderfs", "./binderfs") = 0 [pid 544] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 544] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 544] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 544] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 544] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 544] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 544] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[546]}, 88) = 546 [pid 544] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 544] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 544] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 544] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 544] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 544] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 544] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[547]}, 88) = 547 [pid 544] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 544] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 544] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=514, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- ./strace-static-x86_64: Process 547 attached ./strace-static-x86_64: Process 546 attached [pid 536] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [ 24.702642][ T526] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.708766][ T540] loop5: detected capacity change from 0 to 512 [ 24.715291][ T526] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/7/bus supports timestamps until 2038 (0x7fffffff) [ 24.736970][ T535] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 529] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 536] <... futex resumed>) = 1 [pid 547] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 547] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 547] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 536] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] <... futex resumed>) = 0 [pid 529] <... write resumed>) = 1045 [pid 297] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 547] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 529] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 546] set_robust_list(0x7f0c4a20e9a0, 24 [pid 529] <... futex resumed>) = 1 [pid 526] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 525] <... futex resumed>) = 0 [pid 297] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 546] <... set_robust_list resumed>) = 0 [pid 529] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 526] ioctl(6, LOOP_CLR_FD [pid 525] exit_group(0 [pid 546] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... openat resumed>) = 3 [pid 525] <... exit_group resumed>) = ? [pid 533] <... futex resumed>) = 3 [pid 529] <... futex resumed>) = ? [pid 297] newfstatat(3, "", [pid 533] +++ exited with 0 +++ [pid 547] <... futex resumed>) = 1 [pid 544] <... futex resumed>) = 0 [pid 547] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 544] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 547] <... mount resumed>) = 0 [pid 546] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 544] <... futex resumed>) = 0 [pid 529] +++ exited with 0 +++ [pid 526] <... ioctl resumed>) = 0 [pid 525] +++ exited with 0 +++ [pid 547] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 546] memfd_create("syzkaller", 0 [pid 544] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 526] close(6 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=525, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 297] getdents64(3, [pid 547] <... futex resumed>) = 0 [pid 546] <... memfd_create resumed>) = 4 [pid 544] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 526] <... close resumed>) = 0 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 547] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 546] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 544] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 526] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... restart_syscall resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 547] <... open resumed>) = 5 [pid 546] <... mmap resumed>) = 0x7f0c41dcd000 [pid 544] <... futex resumed>) = 0 [pid 526] <... futex resumed>) = 0 [pid 297] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 547] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 544] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 547] <... futex resumed>) = 0 [pid 544] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 547] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 546] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 544] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 526] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 523] exit_group(0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = 0 [pid 547] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 544] <... futex resumed>) = 0 [pid 298] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 547] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 546] <... write resumed>) = 262144 [pid 544] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 527] <... futex resumed>) = ? [pid 526] <... futex resumed>) = ? [pid 523] <... exit_group resumed>) = ? [pid 298] <... openat resumed>) = 3 [pid 297] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 547] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 546] munmap(0x7f0c41dcd000, 138412032 [pid 527] +++ exited with 0 +++ [pid 526] +++ exited with 0 +++ [pid 298] newfstatat(3, "", [pid 547] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 547] <... futex resumed>) = 1 [pid 546] <... munmap resumed>) = 0 [pid 544] <... futex resumed>) = 0 [pid 298] getdents64(3, [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 547] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 546] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 544] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 547] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 544] <... futex resumed>) = 0 [pid 298] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 547] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 544] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 547] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 547] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 544] <... futex resumed>) = 0 [pid 547] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 546] <... openat resumed>) = 6 [ 24.752667][ T535] EXT4-fs error (device loop1): ext4_quota_enable:6369: comm syz-executor170: Bad quota inode: 3, type: 0 [ 24.778968][ T535] EXT4-fs warning (device loop1): ext4_enable_quotas:6410: Failed to enable quota tracking (type=0, err=-117, ino=3). Please run e2fsck to fix. [ 24.783865][ T540] EXT4-fs (loop5): 1 orphan inode deleted [ 24.794391][ T535] EXT4-fs (loop1): mount failed [pid 297] newfstatat(AT_FDCWD, "./7/bus", [pid 546] ioctl(6, LOOP_SET_FD, 4 [pid 298] <... umount2 resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 546] <... ioctl resumed>) = 0 [pid 546] close(4) = 0 [pid 546] mkdir("./file1", 0777) = 0 [pid 546] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 297] unlink("./7/bus") = 0 [pid 297] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] unlink("./7/binderfs") = 0 [pid 297] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./7/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./7/file1") = 0 [pid 297] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./7") = 0 [pid 297] mkdir("./8", 0777) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 3 [pid 297] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 550 ./strace-static-x86_64: Process 550 attached [pid 550] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 550] chdir("./8") = 0 [pid 550] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 550] setpgid(0, 0) = 0 [pid 550] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 550] write(3, "1000", 4) = 4 [pid 550] close(3) = 0 [pid 550] symlink("/dev/binderfs", "./binderfs") = 0 [pid 550] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 550] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 550] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 298] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 550] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 550] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 535] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./7/bus", [pid 535] ioctl(4, LOOP_CLR_FD) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./7/bus" [pid 535] close(4 [pid 550] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 550] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 298] <... unlink resumed>) = 0 [pid 535] <... close resumed>) = 0 [pid 535] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 550] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 550] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 535] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 535] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 534] exit_group(0 [pid 298] newfstatat(AT_FDCWD, "./7/binderfs", [pid 536] <... futex resumed>) = ? [pid 534] <... exit_group resumed>) = ? [pid 536] +++ exited with 0 +++ [pid 535] <... futex resumed>) = ? [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 550] <... clone3 resumed> => {parent_tid=[551]}, 88) = 551 [pid 550] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 550] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 550] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 550] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 550] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 550] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 298] unlink("./7/binderfs" [pid 550] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[552]}, 88) = 552 [pid 550] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 550] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... unlink resumed>) = 0 [pid 298] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 552 attached ./strace-static-x86_64: Process 551 attached [pid 550] <... futex resumed>) = 0 [pid 523] +++ exited with 0 +++ [pid 552] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=523, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 552] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 552] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 296] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW [pid 552] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 552] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 552] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... openat resumed>) = 3 [pid 551] set_robust_list(0x7f0c4a20e9a0, 24 [pid 550] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] newfstatat(3, "", [pid 551] <... set_robust_list resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 104 [ 24.799871][ T540] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.804453][ T546] loop0: detected capacity change from 0 to 512 [ 24.815523][ T540] ext4 filesystem being mounted at /root/syzkaller.o9q2AS/8/file1 supports timestamps until 2038 (0x7fffffff) [pid 296] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 296] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./7/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./7/bus") = 0 [pid 296] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(AT_FDCWD, "./7/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] unlink("./7/binderfs") = 0 [pid 296] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] close(3) = 0 [pid 296] rmdir("./7") = 0 [pid 296] mkdir("./8", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 555 [pid 550] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 550] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 550] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 551] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 551] memfd_create("syzkaller", 0) = 4 [pid 551] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 551] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 552] <... futex resumed>) = 0 [pid 551] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 551] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 5 [pid 551] ioctl(5, LOOP_SET_FD, 4 [pid 552] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 535] +++ exited with 0 +++ [pid 534] +++ exited with 0 +++ ./strace-static-x86_64: Process 555 attached [pid 552] <... mount resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=534, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 298] <... umount2 resumed>) = 0 [pid 295] umount2("./7", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./7", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] newfstatat(3, "", [pid 298] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] getdents64(3, [pid 298] newfstatat(AT_FDCWD, "./7/file1", [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./7/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] openat(AT_FDCWD, "./7/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 298] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 298] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 298] close(4) = 0 [pid 298] rmdir("./7/file1") = 0 [pid 298] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 555] set_robust_list(0x555556d8d6a0, 24 [pid 298] rmdir("./7" [pid 295] <... umount2 resumed>) = 0 [pid 295] umount2("./7/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./7/bus", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./7/bus") = 0 [pid 295] umount2("./7/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./7/binderfs", [pid 298] <... rmdir resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] unlink("./7/binderfs") = 0 [pid 298] mkdir("./8", 0777 [pid 295] getdents64(3, [pid 298] <... mkdir resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 295] rmdir("./7" [pid 298] <... openat resumed>) = 3 [pid 295] <... rmdir resumed>) = 0 [pid 298] ioctl(3, LOOP_CLR_FD [pid 295] mkdir("./8", 0777 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... mkdir resumed>) = 0 [pid 298] close(3 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 555] <... set_robust_list resumed>) = 0 [pid 546] <... mount resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 555] chdir("./8" [pid 552] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 551] <... ioctl resumed>) = 0 [pid 555] <... chdir resumed>) = 0 [pid 555] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 552] <... futex resumed>) = 1 [pid 550] <... futex resumed>) = 0 [pid 555] <... prctl resumed>) = 0 [pid 552] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 550] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] setpgid(0, 0 [pid 552] <... open resumed>) = 6 [pid 550] <... futex resumed>) = 0 [pid 546] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 555] <... setpgid resumed>) = 0 [pid 552] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 555] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 552] <... futex resumed>) = 0 [pid 550] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 546] <... openat resumed>) = 4 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] ioctl(3, LOOP_CLR_FD [pid 555] <... openat resumed>) = 3 [pid 552] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 551] close(4 [pid 550] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 555] write(3, "1000", 4 [pid 551] <... close resumed>) = 0 [pid 550] <... futex resumed>) = 0 [pid 546] chdir("./file1" [pid 295] close(3 [pid 555] <... write resumed>) = 4 [pid 551] mkdir("./file1", 0777 [pid 550] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 555] close(3 [pid 551] <... mkdir resumed>) = 0 [pid 546] <... chdir resumed>) = 0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 557 [pid 295] <... close resumed>) = 0 [pid 555] <... close resumed>) = 0 [pid 555] symlink("/dev/binderfs", "./binderfs" [pid 551] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 546] ioctl(6, LOOP_CLR_FD [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 555] <... symlink resumed>) = 0 [pid 546] <... ioctl resumed>) = 0 [pid 555] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 546] close(6 [pid 555] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 546] <... close resumed>) = 0 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 558 [pid 555] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 546] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 546] <... futex resumed>) = 0 [pid 555] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 546] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 555] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 555] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 555] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 555] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0}./strace-static-x86_64: Process 558 attached ./strace-static-x86_64: Process 557 attached [pid 552] <... write resumed>) = 8 ./strace-static-x86_64: Process 559 attached [pid 558] set_robust_list(0x555556d8d6a0, 24 [pid 557] set_robust_list(0x555556d8d6a0, 24 [pid 555] <... clone3 resumed> => {parent_tid=[559]}, 88) = 559 [pid 552] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 540] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 559] set_robust_list(0x7f0c4a20e9a0, 24 [pid 558] <... set_robust_list resumed>) = 0 [pid 557] <... set_robust_list resumed>) = 0 [pid 555] rt_sigprocmask(SIG_SETMASK, [], [pid 552] <... futex resumed>) = 1 [pid 550] <... futex resumed>) = 0 [pid 544] exit_group(0 [pid 540] ioctl(5, LOOP_CLR_FD [pid 559] <... set_robust_list resumed>) = 0 [pid 558] chdir("./8" [pid 557] chdir("./8" [pid 555] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 552] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 550] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 547] <... futex resumed>) = ? [pid 546] <... futex resumed>) = ? [pid 544] <... exit_group resumed>) = ? [pid 559] rt_sigprocmask(SIG_SETMASK, [], [pid 558] <... chdir resumed>) = 0 [pid 557] <... chdir resumed>) = 0 [pid 555] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 552] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 550] <... futex resumed>) = 0 [pid 547] +++ exited with 0 +++ [pid 546] +++ exited with 0 +++ [pid 559] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 558] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 557] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 555] <... futex resumed>) = 0 [pid 552] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 550] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 544] +++ exited with 0 +++ [pid 559] memfd_create("syzkaller", 0 [pid 558] <... prctl resumed>) = 0 [pid 557] <... prctl resumed>) = 0 [pid 555] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 552] <... write resumed>) = 1045 [pid 559] <... memfd_create resumed>) = 3 [pid 558] setpgid(0, 0 [pid 557] setpgid(0, 0 [pid 555] <... futex resumed>) = 0 [pid 552] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 559] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 558] <... setpgid resumed>) = 0 [pid 557] <... setpgid resumed>) = 0 [pid 555] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 552] <... futex resumed>) = 1 [pid 550] <... futex resumed>) = 0 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=544, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 559] <... mmap resumed>) = 0x7f0c41dee000 [pid 558] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 557] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 555] <... mmap resumed>) = 0x7f0c41dcd000 [pid 552] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 559] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 558] <... openat resumed>) = 3 [pid 557] <... openat resumed>) = 3 [pid 555] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 559] <... write resumed>) = 262144 [pid 558] write(3, "1000", 4 [pid 557] write(3, "1000", 4 [pid 555] <... mprotect resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 559] munmap(0x7f0c41dee000, 138412032 [pid 558] <... write resumed>) = 4 [pid 557] <... write resumed>) = 4 [pid 555] rt_sigprocmask(SIG_BLOCK, ~[], [pid 559] <... munmap resumed>) = 0 [ 24.850658][ T546] EXT4-fs (loop0): 1 orphan inode deleted [ 24.858803][ T546] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.859683][ T551] loop3: detected capacity change from 0 to 512 [ 24.878835][ T546] ext4 filesystem being mounted at /root/syzkaller.iF59aB/8/file1 supports timestamps until 2038 (0x7fffffff) [pid 558] close(3 [pid 557] close(3 [pid 555] <... rt_sigprocmask resumed>[], 8) = 0 [pid 559] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 558] <... close resumed>) = 0 [pid 557] <... close resumed>) = 0 [pid 555] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 559] <... openat resumed>) = 4 [pid 558] symlink("/dev/binderfs", "./binderfs" [pid 557] symlink("/dev/binderfs", "./binderfs" [pid 559] ioctl(4, LOOP_SET_FD, 3 [pid 558] <... symlink resumed>) = 0 [pid 557] <... symlink resumed>) = 0 [pid 555] <... clone3 resumed> => {parent_tid=[562]}, 88) = 562 [pid 294] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 294] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 562 attached [pid 562] set_robust_list(0x7f0c41ded9a0, 24) = 0 [pid 562] rt_sigprocmask(SIG_SETMASK, [], [pid 559] <... ioctl resumed>) = 0 [pid 558] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] rt_sigprocmask(SIG_SETMASK, [], [pid 540] <... ioctl resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 562] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 559] close(3 [pid 558] <... futex resumed>) = 0 [pid 557] <... futex resumed>) = 0 [pid 555] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 540] close(5 [pid 294] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 562] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 559] <... close resumed>) = 0 [pid 558] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 557] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 555] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 551] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 540] <... close resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 559] mkdir("./bus", 0777 [pid 558] <... rt_sigaction resumed>NULL, 8) = 0 [pid 557] <... rt_sigaction resumed>NULL, 8) = 0 [pid 555] <... futex resumed>) = 0 [pid 540] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 562] <... open resumed>) = -1 EISDIR (Is a directory) [pid 559] <... mkdir resumed>) = 0 [pid 558] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 557] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 555] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 540] <... futex resumed>) = 0 [pid 294] newfstatat(AT_FDCWD, "./8/bus", [pid 559] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 558] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 557] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 540] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 562] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 557] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 551] ioctl(5, LOOP_CLR_FD [pid 562] <... futex resumed>) = 1 [pid 558] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 557] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 555] <... futex resumed>) = 0 [pid 551] <... ioctl resumed>) = 0 [pid 294] unlink("./8/bus" [pid 562] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 558] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 557] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 555] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 551] close(5 [pid 532] exit_group(0 [pid 562] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 558] <... mprotect resumed>) = 0 [pid 557] <... mprotect resumed>) = 0 [pid 555] <... futex resumed>) = 0 [pid 551] <... close resumed>) = 0 [pid 542] <... futex resumed>) = ? [pid 540] <... futex resumed>) = ? [pid 532] <... exit_group resumed>) = ? [pid 294] <... unlink resumed>) = 0 [pid 562] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 558] rt_sigprocmask(SIG_BLOCK, ~[], [pid 557] rt_sigprocmask(SIG_BLOCK, ~[], [pid 555] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 551] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 550] exit_group(0 [pid 542] +++ exited with 0 +++ [pid 540] +++ exited with 0 +++ [pid 532] +++ exited with 0 +++ [pid 558] <... rt_sigprocmask resumed>[], 8) = 0 [pid 557] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=532, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 550] <... exit_group resumed>) = ? [pid 552] <... futex resumed>) = ? [pid 294] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 558] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 557] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 551] <... futex resumed>) = ? [pid 552] +++ exited with 0 +++ [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 565 attached ./strace-static-x86_64: Process 564 attached [pid 562] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 558] <... clone3 resumed> => {parent_tid=[564]}, 88) = 564 [pid 557] <... clone3 resumed> => {parent_tid=[565]}, 88) = 565 [pid 294] newfstatat(AT_FDCWD, "./8/binderfs", [pid 558] rt_sigprocmask(SIG_SETMASK, [], [pid 557] rt_sigprocmask(SIG_SETMASK, [], [pid 558] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 557] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 558] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 557] <... futex resumed>) = 0 [pid 558] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 557] <... futex resumed>) = 0 [pid 558] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 557] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 558] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 557] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 558] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 557] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 558] <... mprotect resumed>) = 0 [pid 557] <... mprotect resumed>) = 0 [pid 558] rt_sigprocmask(SIG_BLOCK, ~[], [pid 557] rt_sigprocmask(SIG_BLOCK, ~[], [pid 558] <... rt_sigprocmask resumed>[], 8) = 0 [pid 557] <... rt_sigprocmask resumed>[], 8) = 0 [pid 558] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 557] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 558] <... clone3 resumed> => {parent_tid=[567]}, 88) = 567 [pid 557] <... clone3 resumed> => {parent_tid=[568]}, 88) = 568 [pid 558] rt_sigprocmask(SIG_SETMASK, [], [pid 557] rt_sigprocmask(SIG_SETMASK, [], [pid 558] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 557] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 558] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = 0 [pid 557] <... futex resumed>) = 0 [pid 558] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 557] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 568 attached [ 24.929797][ T551] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 24.934950][ T559] loop2: detected capacity change from 0 to 512 [ 24.949764][ T551] EXT4-fs (loop3): get root inode failed [ 24.955425][ T551] EXT4-fs (loop3): mount failed [pid 568] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 562] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 565] set_robust_list(0x7f0c4a20e9a0, 24 [pid 564] set_robust_list(0x7f0c4a20e9a0, 24 [pid 562] <... futex resumed>) = 1 [pid 555] <... futex resumed>) = 0 [pid 294] unlink("./8/binderfs" [pid 555] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 555] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 568] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 568] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 568] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] <... futex resumed>) = 0 [pid 557] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 557] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 568] <... futex resumed>) = 1 [pid 568] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 ./strace-static-x86_64: Process 567 attached [pid 567] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 568] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 567] rt_sigprocmask(SIG_SETMASK, [], [pid 557] <... futex resumed>) = 0 [pid 557] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 557] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 567] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 568] <... futex resumed>) = 1 [pid 567] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 568] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 567] <... open resumed>) = 3 [pid 568] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] <... futex resumed>) = 0 [pid 557] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 557] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 568] <... futex resumed>) = 1 [pid 568] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 568] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 557] <... futex resumed>) = 0 [pid 557] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 568] <... futex resumed>) = 1 [pid 557] <... futex resumed>) = 0 [pid 568] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 557] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 568] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 568] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 567] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 568] <... futex resumed>) = 1 [pid 567] <... futex resumed>) = 1 [pid 558] <... futex resumed>) = 0 [pid 557] <... futex resumed>) = 0 [pid 568] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 567] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 558] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 567] <... mount resumed>) = 0 [pid 558] <... futex resumed>) = 0 [pid 567] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 567] <... futex resumed>) = 0 [pid 558] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 567] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 558] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 567] <... open resumed>) = 4 [pid 565] <... set_robust_list resumed>) = 0 [pid 564] <... set_robust_list resumed>) = 0 [pid 562] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 558] <... futex resumed>) = 0 [pid 299] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... unlink resumed>) = 0 [pid 567] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 565] rt_sigprocmask(SIG_SETMASK, [], [pid 564] rt_sigprocmask(SIG_SETMASK, [], [pid 562] <... open resumed>) = -1 EISDIR (Is a directory) [pid 558] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 567] <... futex resumed>) = 0 [pid 565] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 564] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 562] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 558] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 299] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 567] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 565] memfd_create("syzkaller", 0 [pid 564] memfd_create("syzkaller", 0 [pid 562] <... futex resumed>) = 1 [pid 558] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 567] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 565] <... memfd_create resumed>) = 5 [pid 564] <... memfd_create resumed>) = 5 [pid 562] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 558] <... futex resumed>) = 0 [pid 555] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(3, "", [pid 567] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 565] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 564] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 562] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 558] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 555] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 567] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 565] <... mmap resumed>) = 0x7f0c41dcd000 [pid 564] <... mmap resumed>) = 0x7f0c41dcd000 [pid 562] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 559] <... mount resumed>) = 0 [pid 555] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 559] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 299] getdents64(3, [pid 559] <... openat resumed>) = 3 [pid 559] chdir("./bus") = 0 [pid 559] ioctl(4, LOOP_CLR_FD) = 0 [pid 559] close(4) = 0 [pid 559] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 559] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 567] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 567] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 565] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 562] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 562] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 562] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 299] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./8/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./8/binderfs") = 0 [pid 299] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./8/file1", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./8/file1") = 0 [pid 299] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] close(3) = 0 [pid 299] rmdir("./8") = 0 [pid 299] mkdir("./9", 0777 [pid 558] <... futex resumed>) = 0 [pid 555] <... futex resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 3 [pid 299] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 299] close(3) = 0 [pid 551] +++ exited with 0 +++ [pid 550] +++ exited with 0 +++ [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 569 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=550, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 564] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 297] <... restart_syscall resumed>) = 0 [pid 564] <... write resumed>) = 262144 [ 24.974780][ T559] EXT4-fs (loop2): 1 orphan inode deleted [ 24.981106][ T559] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 24.993266][ T559] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/8/bus supports timestamps until 2038 (0x7fffffff) [pid 558] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 555] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 569 attached [pid 567] <... futex resumed>) = 0 [pid 565] <... write resumed>) = 262144 [pid 564] munmap(0x7f0c41dcd000, 138412032 [pid 559] <... futex resumed>) = 0 [pid 558] <... futex resumed>) = 1 [pid 555] <... futex resumed>) = 1 [pid 569] set_robust_list(0x555556d8d6a0, 24 [pid 567] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 565] munmap(0x7f0c41dcd000, 138412032 [pid 564] <... munmap resumed>) = 0 [pid 559] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 558] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 555] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 569] <... set_robust_list resumed>) = 0 [pid 567] <... write resumed>) = -1 ENOSPC (No space left on device) [pid 565] <... munmap resumed>) = 0 [pid 564] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 559] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 569] chdir("./9" [pid 567] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 565] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 564] <... openat resumed>) = 6 [pid 559] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 569] <... chdir resumed>) = 0 [pid 567] <... futex resumed>) = 1 [pid 565] <... openat resumed>) = 6 [pid 564] ioctl(6, LOOP_SET_FD, 5 [pid 559] <... futex resumed>) = 1 [pid 558] <... futex resumed>) = 0 [pid 555] <... futex resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 569] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 567] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 565] ioctl(6, LOOP_SET_FD, 5 [pid 559] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 555] exit_group(0 [pid 569] <... prctl resumed>) = 0 [pid 564] <... ioctl resumed>) = 0 [pid 297] newfstatat(3, "", [pid 569] setpgid(0, 0 [pid 564] close(5 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 569] <... setpgid resumed>) = 0 [pid 564] <... close resumed>) = 0 [pid 297] getdents64(3, [pid 569] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 564] mkdir("./file1", 0777 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 569] <... openat resumed>) = 3 [pid 564] <... mkdir resumed>) = 0 [pid 297] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 569] write(3, "1000", 4 [pid 564] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 569] <... write resumed>) = 4 [pid 569] close(3) = 0 [pid 569] symlink("/dev/binderfs", "./binderfs" [pid 297] <... umount2 resumed>) = 0 [pid 569] <... symlink resumed>) = 0 [pid 562] <... futex resumed>) = ? [pid 559] <... futex resumed>) = ? [pid 555] <... exit_group resumed>) = ? [pid 297] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 569] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 565] <... ioctl resumed>) = 0 [pid 562] +++ exited with 0 +++ [pid 559] +++ exited with 0 +++ [pid 555] +++ exited with 0 +++ [pid 294] <... umount2 resumed>) = 0 [pid 569] <... futex resumed>) = 0 [pid 565] close(5 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 569] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 565] <... close resumed>) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=555, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 294] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 565] mkdir("./file1", 0777) = 0 [pid 565] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 569] <... rt_sigaction resumed>NULL, 8) = 0 [pid 297] newfstatat(AT_FDCWD, "./8/bus", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 569] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] newfstatat(AT_FDCWD, "./8/file1", [pid 569] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] unlink("./8/bus" [pid 296] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 569] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 569] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 297] <... unlink resumed>) = 0 [pid 296] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 569] <... mprotect resumed>) = 0 [pid 297] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... openat resumed>) = 3 [pid 294] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 569] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] newfstatat(3, "", [pid 294] <... openat resumed>) = 4 [pid 569] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] newfstatat(AT_FDCWD, "./8/binderfs", [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] newfstatat(4, "", [pid 569] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] getdents64(3, [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] unlink("./8/binderfs" [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] getdents64(4, [pid 569] <... clone3 resumed> => {parent_tid=[572]}, 88) = 572 [pid 297] <... unlink resumed>) = 0 [pid 296] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 ./strace-static-x86_64: Process 572 attached [pid 569] rt_sigprocmask(SIG_SETMASK, [], [pid 297] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] getdents64(4, [pid 569] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 569] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] newfstatat(AT_FDCWD, "./8/file1", [pid 294] close(4 [pid 569] <... futex resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... close resumed>) = 0 [pid 569] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] rmdir("./8/file1" [pid 569] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... rmdir resumed>) = 0 [pid 569] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] getdents64(3, [pid 569] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 297] <... openat resumed>) = 4 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 569] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 297] newfstatat(4, "", [pid 294] close(3 [pid 569] <... mprotect resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... close resumed>) = 0 [ 25.024705][ T564] loop1: detected capacity change from 0 to 512 [ 25.026867][ T565] loop4: detected capacity change from 0 to 512 [ 25.048642][ T564] EXT4-fs (loop1): 1 orphan inode deleted [ 25.054285][ T564] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 569] rt_sigprocmask(SIG_BLOCK, ~[], [pid 297] getdents64(4, [pid 294] rmdir("./8" [pid 569] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] <... rmdir resumed>) = 0 [pid 569] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 297] getdents64(4, [pid 294] mkdir("./9", 0777 [pid 572] set_robust_list(0x7f0c4a20e9a0, 24 [pid 297] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 572] <... set_robust_list resumed>) = 0 [pid 569] <... clone3 resumed> => {parent_tid=[574]}, 88) = 574 [pid 297] close(4 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 569] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... close resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 569] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] rmdir("./8/file1" [pid 294] ioctl(3, LOOP_CLR_FD [pid 569] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... rmdir resumed>) = 0 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 569] <... futex resumed>) = 0 [pid 297] getdents64(3, [pid 294] close(3 [pid 569] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... close resumed>) = 0 [pid 297] close(3 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] <... close resumed>) = 0 [pid 297] rmdir("./8" [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 576 [pid 297] <... rmdir resumed>) = 0 [pid 297] mkdir("./9", 0777./strace-static-x86_64: Process 574 attached [pid 572] rt_sigprocmask(SIG_SETMASK, [], [pid 297] <... mkdir resumed>) = 0 [pid 572] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 572] memfd_create("syzkaller", 0 [pid 297] <... openat resumed>) = 3 [pid 572] <... memfd_create resumed>) = 3 [pid 297] ioctl(3, LOOP_CLR_FD [pid 572] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] close(3) = 0 [pid 572] <... mmap resumed>) = 0x7f0c41dcd000 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 577 [pid 564] <... mount resumed>) = 0 [pid 564] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 5 [pid 564] chdir("./file1") = 0 [pid 564] ioctl(6, LOOP_CLR_FD) = 0 [pid 564] close(6) = 0 [pid 564] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 564] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 576 attached [pid 576] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 574] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 572] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 558] exit_group(0 [pid 567] <... futex resumed>) = ? [pid 564] <... futex resumed>) = ? [pid 558] <... exit_group resumed>) = ? [pid 574] <... set_robust_list resumed>) = 0 [pid 572] <... write resumed>) = 262144 [pid 567] +++ exited with 0 +++ [pid 564] +++ exited with 0 +++ [pid 558] +++ exited with 0 +++ [pid 572] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 572] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 572] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 577 attached [pid 576] chdir("./9" [pid 574] rt_sigprocmask(SIG_SETMASK, [], [pid 565] <... mount resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=558, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 574] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 565] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 574] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 565] <... openat resumed>) = 5 [pid 574] <... open resumed>) = 5 [pid 565] chdir("./file1" [ 25.065631][ T564] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/8/file1 supports timestamps until 2038 (0x7fffffff) [ 25.090744][ T565] EXT4-fs (loop4): 1 orphan inode deleted [ 25.096382][ T565] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 25.109521][ T565] ext4 filesystem being mounted at /root/syzkaller.qPQybd/8/file1 supports timestamps until 2038 (0x7fffffff) [pid 295] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 574] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 565] <... chdir resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 574] <... futex resumed>) = 1 [pid 569] <... futex resumed>) = 0 [pid 565] ioctl(6, LOOP_CLR_FD [pid 295] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 574] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 569] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 565] <... ioctl resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 574] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 569] <... futex resumed>) = 0 [pid 565] close(6 [pid 295] newfstatat(3, "", [pid 577] set_robust_list(0x555556d8d6a0, 24 [pid 576] <... chdir resumed>) = 0 [pid 574] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 572] <... ioctl resumed>) = 0 [pid 569] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 577] <... set_robust_list resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 577] chdir("./9" [pid 576] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 574] <... mount resumed>) = 0 [pid 572] close(3 [pid 565] <... close resumed>) = 0 [pid 295] getdents64(3, [pid 574] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 565] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 574] <... futex resumed>) = 1 [pid 569] <... futex resumed>) = 0 [pid 565] <... futex resumed>) = 0 [pid 557] exit_group(0 [pid 295] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 574] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 569] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 568] <... futex resumed>) = ? [pid 557] <... exit_group resumed>) = ? [pid 577] <... chdir resumed>) = 0 [pid 576] <... prctl resumed>) = 0 [pid 574] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 569] <... futex resumed>) = 0 [pid 568] +++ exited with 0 +++ [pid 565] +++ exited with 0 +++ [pid 557] +++ exited with 0 +++ [pid 295] <... umount2 resumed>) = 0 [pid 577] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 576] setpgid(0, 0 [pid 574] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 569] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 577] <... prctl resumed>) = 0 [pid 576] <... setpgid resumed>) = 0 [pid 574] <... open resumed>) = 6 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=557, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 577] setpgid(0, 0 [pid 576] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 574] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 572] <... close resumed>) = 0 [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 295] newfstatat(AT_FDCWD, "./8/bus", [pid 577] <... setpgid resumed>) = 0 [pid 576] <... openat resumed>) = 3 [pid 574] <... futex resumed>) = 1 [pid 569] <... futex resumed>) = 0 [pid 298] <... restart_syscall resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 574] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 569] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] unlink("./8/bus" [pid 577] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 576] write(3, "1000", 4 [pid 574] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 572] mkdir("./bus", 0777 [pid 569] <... futex resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 577] <... openat resumed>) = 3 [pid 574] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 577] write(3, "1000", 4 [pid 576] <... write resumed>) = 4 [pid 569] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] umount2("./8", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 577] <... write resumed>) = 4 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 577] close(3 [pid 298] openat(AT_FDCWD, "./8", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] newfstatat(AT_FDCWD, "./8/binderfs", [pid 576] close(3 [pid 574] <... write resumed>) = 8 [pid 572] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 577] <... close resumed>) = 0 [pid 576] <... close resumed>) = 0 [pid 574] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 572] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 298] <... openat resumed>) = 3 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 577] symlink("/dev/binderfs", "./binderfs" [pid 576] symlink("/dev/binderfs", "./binderfs" [pid 574] <... futex resumed>) = 1 [pid 569] <... futex resumed>) = 0 [pid 298] newfstatat(3, "", [pid 295] unlink("./8/binderfs" [pid 577] <... symlink resumed>) = 0 [pid 574] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 569] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 577] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 574] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 569] <... futex resumed>) = 0 [pid 298] getdents64(3, [pid 295] <... unlink resumed>) = 0 [pid 577] <... futex resumed>) = 0 [pid 576] <... symlink resumed>) = 0 [pid 574] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 569] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 577] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 576] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 295] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 577] <... rt_sigaction resumed>NULL, 8) = 0 [pid 576] <... futex resumed>) = 0 [pid 298] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 577] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 577] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 577] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 577] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... umount2 resumed>) = 0 [pid 577] <... rt_sigprocmask resumed>[], 8) = 0 [pid 577] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[579]}, 88) = 579 [pid 577] rt_sigprocmask(SIG_SETMASK, [], [pid 298] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 577] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 577] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 577] <... futex resumed>) = 0 [pid 298] newfstatat(AT_FDCWD, "./8/bus", [pid 577] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 577] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 577] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 576] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 577] <... mprotect resumed>) = 0 [pid 577] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 574] <... write resumed>) = 1045 [pid 298] unlink("./8/bus" [pid 577] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 576] <... rt_sigaction resumed>NULL, 8) = 0 [pid 574] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 569] <... futex resumed>) = 0 [pid 576] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 298] <... unlink resumed>) = 0 [pid 577] <... clone3 resumed> => {parent_tid=[580]}, 88) = 580 [pid 577] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 577] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 577] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 579 attached [pid 579] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 579] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 579] memfd_create("syzkaller", 0) = 3 [pid 579] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 579] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 579] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 579] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [pid 574] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 580 attached [pid 576] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 579] ioctl(4, LOOP_SET_FD, 3 [pid 580] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 576] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 579] <... ioctl resumed>) = 0 [pid 579] close(3) = 0 [pid 579] mkdir("./file1", 0777) = 0 [pid 579] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 580] <... set_robust_list resumed>) = 0 [pid 580] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 580] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 580] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 577] <... futex resumed>) = 0 [pid 580] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 577] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 580] <... mount resumed>) = 0 [pid 577] <... futex resumed>) = 0 [pid 580] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 577] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 580] <... futex resumed>) = 0 [pid 577] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 576] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 576] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 298] newfstatat(AT_FDCWD, "./8/binderfs", [pid 576] <... mprotect resumed>) = 0 [pid 576] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 576] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[581]}, 88) = 581 [pid 576] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 576] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 576] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 576] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 576] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 576] <... rt_sigprocmask resumed>[], 8) = 0 [pid 576] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[582]}, 88) = 582 [pid 576] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 576] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 581 attached [pid 581] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 581] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 581] memfd_create("syzkaller", 0) = 3 [pid 581] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 581] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 581] munmap(0x7f0c41dcd000, 138412032 [pid 298] unlink("./8/binderfs" [pid 577] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 581] <... munmap resumed>) = 0 [pid 581] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 577] <... futex resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 580] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 296] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 581] <... openat resumed>) = 4 [pid 581] ioctl(4, LOOP_SET_FD, 3 [pid 577] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [ 25.114389][ T572] loop5: detected capacity change from 0 to 512 [ 25.143578][ T572] ================================================================================ [ 25.153047][ T572] UBSAN: shift-out-of-bounds in fs/ext4/super.c:4423:27 [ 25.153993][ T579] loop3: detected capacity change from 0 to 512 [ 25.160033][ T572] shift exponent 59 is too large for 32-bit type 'int' [pid 298] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] <... open resumed>) = 5 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 580] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] newfstatat(AT_FDCWD, "./8/bus", [pid 581] <... ioctl resumed>) = 0 [pid 581] close(3) = 0 [pid 581] mkdir("./file1", 0777) = 0 [pid 580] <... futex resumed>) = 1 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 577] <... futex resumed>) = 0 [pid 580] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 581] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 577] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./8/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 577] <... futex resumed>) = 0 [pid 580] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 577] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 582 attached [pid 580] <... write resumed>) = 8 [pid 296] openat(AT_FDCWD, "./8/bus", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 580] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... openat resumed>) = 4 [pid 295] <... umount2 resumed>) = 0 [pid 580] <... futex resumed>) = 1 [pid 577] <... futex resumed>) = 0 [pid 296] newfstatat(4, "", [pid 295] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 580] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 577] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 580] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 577] <... futex resumed>) = 0 [pid 296] getdents64(4, [pid 295] newfstatat(AT_FDCWD, "./8/file1", [pid 580] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 577] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [ 25.178824][ T581] loop0: detected capacity change from 0 to 512 [ 25.186822][ T572] CPU: 0 PID: 572 Comm: syz-executor170 Not tainted 5.15.141-syzkaller-00899-g28e3f5851a99 #0 [ 25.196909][ T572] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 [ 25.206804][ T572] Call Trace: [ 25.209923][ T572] [ 25.212697][ T572] dump_stack_lvl+0x151/0x1b7 [ 25.217209][ T572] ? io_uring_drop_tctx_refs+0x190/0x190 [ 25.222678][ T572] ? guard_bio_eod+0xf4/0x140 [ 25.227192][ T572] dump_stack+0x15/0x17 [ 25.231180][ T572] __ubsan_handle_shift_out_of_bounds+0x3bf/0x420 [ 25.237523][ T572] ? ext4_max_size+0xa3/0x120 [ 25.242031][ T572] ext4_fill_super+0x7491/0x96e0 [ 25.246898][ T572] ? ext4_mount+0x40/0x40 [ 25.251058][ T572] ? vscnprintf+0x80/0x80 [ 25.255225][ T572] ? set_blocksize+0x1f0/0x380 [ 25.259822][ T572] ? sb_set_blocksize+0xa8/0xf0 [ 25.264598][ T572] mount_bdev+0x282/0x3b0 [ 25.268762][ T572] ? ext4_mount+0x40/0x40 [ 25.273019][ T572] ext4_mount+0x34/0x40 [ 25.277009][ T572] legacy_get_tree+0xf1/0x190 [ 25.281525][ T572] ? ext4_errno_to_code+0x140/0x140 [ 25.286555][ T572] vfs_get_tree+0x88/0x290 [ 25.290812][ T572] do_new_mount+0x28b/0xad0 [ 25.295165][ T572] ? do_move_mount_old+0x160/0x160 [ 25.300442][ T572] ? security_capable+0x87/0xb0 [ 25.305129][ T572] ? ns_capable+0x89/0xe0 [ 25.309294][ T572] path_mount+0x671/0x1070 [ 25.313550][ T572] __se_sys_mount+0x2c4/0x3b0 [ 25.318061][ T572] ? __x64_sys_mount+0xd0/0xd0 [ 25.322663][ T572] ? __kasan_check_read+0x11/0x20 [ 25.327528][ T572] __x64_sys_mount+0xbf/0xd0 [ 25.331953][ T572] do_syscall_64+0x3d/0xb0 [ 25.336201][ T572] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.342017][ T572] RIP: 0033:0x7f0c4a25309a [ 25.346271][ T572] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb a6 e8 5e 04 00 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 25.365708][ T572] RSP: 002b:00007f0c4a20e088 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [pid 580] <... write resumed>) = 1045 [pid 577] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 576] <... futex resumed>) = -1 ETIMEDOUT (Connection timed out) [pid 296] getdents64(4, [pid 295] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 576] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ac000 [pid 576] mprotect(0x7f0c4a1ad000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 576] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 576] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1cc990, parent_tid=0x7f0c4a1cc990, exit_signal=0, stack=0x7f0c4a1ac000, stack_size=0x20300, tls=0x7f0c4a1cc6c0} => {parent_tid=[584]}, 88) = 584 [pid 576] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 576] futex(0x7f0c4a2da6e8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 576] futex(0x7f0c4a2da6ec, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 582] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 582] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 582] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 582] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 582] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 580] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 580] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 584 attached [pid 296] close(4 [pid 295] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] <... close resumed>) = 0 [pid 296] rmdir("./8/bus" [pid 295] <... openat resumed>) = 4 [pid 296] <... rmdir resumed>) = 0 [pid 295] newfstatat(4, "", [pid 584] set_robust_list(0x7f0c4a1cc9a0, 24) = 0 [pid 584] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 584] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [ 25.373961][ T572] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f0c4a25309a [ 25.381885][ T572] RDX: 0000000020000040 RSI: 0000000020000080 RDI: 00007f0c4a20e0a0 [ 25.389665][ T572] RBP: 00007f0c4a20e0a0 R08: 00007f0c4a20e0e0 R09: 00000000000004d6 [ 25.397565][ T572] R10: 0000000000004500 R11: 0000000000000202 R12: 00007f0c4a20e0e0 [ 25.405373][ T572] R13: 0000000000004500 R14: 0000000000000003 R15: 0000000000040000 [ 25.413189][ T572] [ 25.416554][ T572] ================================================================================ [pid 584] futex(0x7f0c4a2da6ec, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] <... futex resumed>) = 0 [pid 576] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 582] <... futex resumed>) = 0 [pid 576] <... futex resumed>) = 1 [pid 582] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 576] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 582] <... open resumed>) = 5 [pid 582] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 576] <... futex resumed>) = 0 [pid 582] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 576] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 582] <... write resumed>) = 8 [pid 576] <... futex resumed>) = 0 [pid 582] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 582] <... futex resumed>) = 0 [pid 576] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 582] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 576] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 582] <... write resumed>) = 1045 [pid 576] <... futex resumed>) = 0 [pid 582] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 582] <... futex resumed>) = 0 [pid 576] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 582] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 584] <... futex resumed>) = 1 [pid 584] futex(0x7f0c4a2da6e8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 572] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./8/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] getdents64(4, [pid 296] newfstatat(AT_FDCWD, "./8/binderfs", [pid 295] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] getdents64(4, [pid 296] unlink("./8/binderfs" [pid 295] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] <... unlink resumed>) = 0 [pid 295] close(4 [pid 296] getdents64(3, [pid 295] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] rmdir("./8/file1" [pid 296] close(3 [pid 295] <... rmdir resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 295] getdents64(3, [pid 296] rmdir("./8" [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 295] close(3 [pid 296] mkdir("./9", 0777 [pid 295] <... close resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 295] rmdir("./8" [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] <... rmdir resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] mkdir("./9", 0777 [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] <... mkdir resumed>) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 296] close(3 [pid 295] <... openat resumed>) = 3 [pid 296] <... close resumed>) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] close(3 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 588 [pid 295] <... close resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 589 ./strace-static-x86_64: Process 588 attached [pid 588] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 588] chdir("./9") = 0 [pid 588] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 588] setpgid(0, 0) = 0 [pid 588] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 588] write(3, "1000", 4) = 4 [pid 588] close(3) = 0 [pid 588] symlink("/dev/binderfs", "./binderfs") = 0 [pid 588] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 588] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 588] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 588] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 588] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 588] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 588] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[591]}, 88) = 591 [pid 588] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 588] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 588] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 588] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0./strace-static-x86_64: Process 591 attached ./strace-static-x86_64: Process 589 attached [pid 572] ioctl(4, LOOP_CLR_FD [pid 591] set_robust_list(0x7f0c4a20e9a0, 24 [pid 589] set_robust_list(0x555556d8d6a0, 24 [pid 572] <... ioctl resumed>) = 0 [pid 591] <... set_robust_list resumed>) = 0 [pid 589] <... set_robust_list resumed>) = 0 [pid 572] close(4 [pid 591] rt_sigprocmask(SIG_SETMASK, [], [pid 589] chdir("./9" [pid 572] <... close resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 591] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 589] <... chdir resumed>) = 0 [pid 572] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 591] memfd_create("syzkaller", 0 [pid 589] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 572] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 591] <... memfd_create resumed>) = 3 [pid 589] <... prctl resumed>) = 0 [pid 579] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 572] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] newfstatat(AT_FDCWD, "./8/file1", [pid 591] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 589] setpgid(0, 0 [pid 579] ioctl(4, LOOP_CLR_FD [pid 569] exit_group(0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 591] <... mmap resumed>) = 0x7f0c41dee000 [ 25.426795][ T572] EXT4-fs (loop5): fragment/cluster size (0) != block size (4096) [ 25.434129][ T579] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 25.450269][ T579] EXT4-fs (loop3): get root inode failed [ 25.456106][ T579] EXT4-fs (loop3): mount failed [ 25.466777][ T581] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [pid 589] <... setpgid resumed>) = 0 [pid 579] <... ioctl resumed>) = 0 [pid 574] <... futex resumed>) = ? [pid 572] <... futex resumed>) = ? [pid 569] <... exit_group resumed>) = ? [pid 298] umount2("./8/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 591] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 589] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 588] <... mmap resumed>) = 0x7f0c41dcd000 [pid 579] close(4 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 591] <... write resumed>) = 262144 [pid 589] <... openat resumed>) = 3 [pid 579] <... close resumed>) = 0 [pid 574] +++ exited with 0 +++ [pid 572] +++ exited with 0 +++ [pid 298] openat(AT_FDCWD, "./8/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 591] munmap(0x7f0c41dee000, 138412032 [pid 589] write(3, "1000", 4 [pid 588] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 579] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... openat resumed>) = 4 [pid 591] <... munmap resumed>) = 0 [pid 589] <... write resumed>) = 4 [pid 579] <... futex resumed>) = 0 [pid 298] newfstatat(4, "", [pid 591] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 589] close(3 [pid 579] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 591] <... openat resumed>) = 4 [pid 589] <... close resumed>) = 0 [pid 298] getdents64(4, [pid 591] ioctl(4, LOOP_SET_FD, 3 [pid 589] symlink("/dev/binderfs", "./binderfs" [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 591] <... ioctl resumed>) = 0 [pid 589] <... symlink resumed>) = 0 [pid 588] <... mprotect resumed>) = 0 [pid 298] getdents64(4, [pid 589] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 589] <... futex resumed>) = 0 [pid 298] close(4 [pid 589] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 298] <... close resumed>) = 0 [pid 589] <... rt_sigaction resumed>NULL, 8) = 0 [pid 298] rmdir("./8/file1" [pid 589] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 298] <... rmdir resumed>) = 0 [pid 589] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] getdents64(3, [pid 589] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 589] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 298] close(3 [pid 589] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 298] <... close resumed>) = 0 [pid 589] <... mprotect resumed>) = 0 [pid 298] rmdir("./8" [pid 589] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... rmdir resumed>) = 0 [pid 589] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] mkdir("./9", 0777 [pid 589] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 298] <... mkdir resumed>) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 589] <... clone3 resumed> => {parent_tid=[592]}, 88) = 592 [pid 298] <... openat resumed>) = 3 [pid 589] rt_sigprocmask(SIG_SETMASK, [], [pid 298] ioctl(3, LOOP_CLR_FD [pid 589] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 589] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 589] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 589] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 589] <... futex resumed>) = 0 [pid 589] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 593 [pid 589] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 589] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 589] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 589] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[594]}, 88) = 594 [pid 591] close(3 [pid 589] rt_sigprocmask(SIG_SETMASK, [], [pid 591] <... close resumed>) = 0 [pid 589] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 591] mkdir("./file1", 0777 [pid 589] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 594 attached ./strace-static-x86_64: Process 593 attached ./strace-static-x86_64: Process 592 attached [pid 591] <... mkdir resumed>) = 0 [pid 589] <... futex resumed>) = 0 [pid 588] rt_sigprocmask(SIG_BLOCK, ~[], [pid 577] exit_group(0 [pid 594] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 593] set_robust_list(0x555556d8d6a0, 24 [pid 592] set_robust_list(0x7f0c4a20e9a0, 24 [pid 591] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 589] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 581] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 594] <... set_robust_list resumed>) = 0 [pid 593] <... set_robust_list resumed>) = 0 [pid 592] <... set_robust_list resumed>) = 0 [pid 588] <... rt_sigprocmask resumed>[], 8) = 0 [pid 580] <... futex resumed>) = ? [pid 579] <... futex resumed>) = ? [pid 577] <... exit_group resumed>) = ? [pid 594] rt_sigprocmask(SIG_SETMASK, [], [pid 593] chdir("./9" [pid 592] rt_sigprocmask(SIG_SETMASK, [], [pid 588] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 581] ioctl(4, LOOP_CLR_FD [pid 580] +++ exited with 0 +++ [pid 579] +++ exited with 0 +++ [pid 581] <... ioctl resumed>) = 0 [pid 581] close(4) = 0 [pid 581] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 581] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 576] exit_group(0 [pid 588] <... clone3 resumed> => {parent_tid=[595]}, 88) = 595 [pid 584] <... futex resumed>) = ? [pid 582] <... futex resumed>) = ? [pid 581] <... futex resumed>) = ? [pid 576] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 595 attached [pid 594] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 593] <... chdir resumed>) = 0 [pid 592] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 588] rt_sigprocmask(SIG_SETMASK, [], [pid 584] +++ exited with 0 +++ [pid 582] +++ exited with 0 +++ [pid 581] +++ exited with 0 +++ [pid 595] set_robust_list(0x7f0c41ded9a0, 24) = 0 [pid 588] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 595] rt_sigprocmask(SIG_SETMASK, [], [pid 594] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 595] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 592] memfd_create("syzkaller", 0 [pid 588] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 595] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 588] <... futex resumed>) = 0 [pid 595] <... open resumed>) = 3 [pid 594] <... open resumed>) = 4 [pid 593] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 592] <... memfd_create resumed>) = 3 [pid 588] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 595] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 595] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 569] +++ exited with 0 +++ [pid 594] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] <... prctl resumed>) = 0 [pid 592] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 588] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 594] <... futex resumed>) = 1 [pid 593] setpgid(0, 0 [pid 592] <... mmap resumed>) = 0x7f0c41dcd000 [pid 588] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=569, si_uid=0, si_status=0, si_utime=0, si_stime=7} --- [pid 594] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 593] <... setpgid resumed>) = 0 [pid 592] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 589] <... futex resumed>) = 0 [pid 588] <... futex resumed>) = 1 [pid 577] +++ exited with 0 +++ [pid 593] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 592] <... write resumed>) = 262144 [pid 589] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 588] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 594] <... futex resumed>) = 0 [pid 593] <... openat resumed>) = 3 [pid 592] munmap(0x7f0c41dcd000, 138412032 [pid 589] <... futex resumed>) = 1 [pid 299] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=577, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 594] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 593] write(3, "1000", 4 [pid 592] <... munmap resumed>) = 0 [pid 589] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 594] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 593] <... write resumed>) = 4 [pid 592] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 299] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 593] close(3 [pid 592] <... openat resumed>) = 5 [pid 299] <... openat resumed>) = 3 [pid 594] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] <... close resumed>) = 0 [pid 592] ioctl(5, LOOP_SET_FD, 3 [pid 299] newfstatat(3, "", [pid 594] <... futex resumed>) = 1 [pid 593] symlink("/dev/binderfs", "./binderfs" [pid 589] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 595] <... futex resumed>) = 0 [pid 594] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 593] <... symlink resumed>) = 0 [pid 589] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 595] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 594] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 589] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 595] <... mount resumed>) = 0 [pid 594] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 589] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] getdents64(3, [pid 297] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 595] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 594] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 593] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 592] <... ioctl resumed>) = 0 [pid 297] <... openat resumed>) = 3 [pid 595] <... futex resumed>) = 1 [pid 594] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] <... futex resumed>) = 0 [pid 592] close(3 [pid 588] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 297] newfstatat(3, "", [pid 595] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 594] <... futex resumed>) = 1 [pid 589] <... futex resumed>) = 0 [pid 588] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 595] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 594] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 589] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 588] <... futex resumed>) = 0 [pid 297] getdents64(3, [pid 595] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 594] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 589] <... futex resumed>) = 0 [pid 588] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 595] <... open resumed>) = 5 [pid 594] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 589] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [ 25.482170][ T581] EXT4-fs (loop0): get root inode failed [ 25.491956][ T591] loop2: detected capacity change from 0 to 512 [ 25.493179][ T581] EXT4-fs (loop0): mount failed [ 25.519132][ T592] loop1: detected capacity change from 0 to 512 [pid 595] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 594] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 595] <... futex resumed>) = 1 [pid 594] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 592] <... close resumed>) = 0 [pid 588] <... futex resumed>) = 0 [pid 299] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... umount2 resumed>) = 0 [pid 595] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 594] <... futex resumed>) = 1 [pid 589] <... futex resumed>) = 0 [pid 588] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 576] +++ exited with 0 +++ [pid 297] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 595] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 594] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 589] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 588] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 595] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 594] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 593] <... rt_sigaction resumed>NULL, 8) = 0 [pid 589] <... futex resumed>) = 0 [pid 588] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 592] mkdir("./file1", 0777 [pid 297] newfstatat(AT_FDCWD, "./9/bus", [pid 595] <... write resumed>) = 8 [pid 594] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 593] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 592] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 589] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... umount2 resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=576, si_uid=0, si_status=0, si_utime=0, si_stime=23} --- [pid 595] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 594] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 593] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 592] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] unlink("./9/bus" [pid 595] <... futex resumed>) = 1 [pid 594] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 593] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 588] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... unlink resumed>) = 0 [pid 595] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 594] <... futex resumed>) = 1 [pid 589] <... futex resumed>) = 0 [pid 588] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 595] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 594] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 588] <... futex resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 595] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 588] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] newfstatat(AT_FDCWD, "./9/binderfs", [pid 595] <... write resumed>) = 1045 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 595] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] unlink("./9/binderfs" [pid 595] <... futex resumed>) = 1 [pid 588] <... futex resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 595] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(AT_FDCWD, "./9/file1", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 297] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 297] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 297] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 297] close(4) = 0 [pid 297] rmdir("./9/file1" [pid 593] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 591] <... mount resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./9/bus", [pid 297] <... rmdir resumed>) = 0 [pid 294] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 593] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 591] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] getdents64(3, [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 593] <... mprotect resumed>) = 0 [pid 591] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 299] unlink("./9/bus" [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 593] rt_sigprocmask(SIG_BLOCK, ~[], [pid 591] ioctl(4, LOOP_CLR_FD [pid 299] <... unlink resumed>) = 0 [pid 297] close(3 [pid 294] <... openat resumed>) = 3 [pid 593] <... rt_sigprocmask resumed>[], 8) = 0 [pid 591] <... ioctl resumed>) = 0 [pid 299] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... close resumed>) = 0 [pid 294] newfstatat(3, "", [pid 593] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 591] close(4 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] rmdir("./9" [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 591] <... close resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./9/binderfs", [pid 297] <... rmdir resumed>) = 0 [pid 294] getdents64(3, [pid 593] <... clone3 resumed> => {parent_tid=[599]}, 88) = 599 [pid 591] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 588] exit_group(0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] mkdir("./10", 0777 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 595] <... futex resumed>) = ? [pid 593] rt_sigprocmask(SIG_SETMASK, [], [pid 591] <... futex resumed>) = ? [pid 588] <... exit_group resumed>) = ? [pid 299] unlink("./9/binderfs" [pid 294] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 595] +++ exited with 0 +++ [pid 593] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 591] +++ exited with 0 +++ [pid 299] <... unlink resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 593] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 588] +++ exited with 0 +++ [pid 299] getdents64(3, [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 294] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 593] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] <... openat resumed>) = 3 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 593] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] close(3 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=588, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 294] newfstatat(AT_FDCWD, "./9/bus", [pid 593] <... futex resumed>) = 0 [pid 299] <... close resumed>) = 0 [ 25.527553][ T591] EXT4-fs (loop2): 1 orphan inode deleted [ 25.534633][ T591] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 25.554187][ T591] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/9/file1 supports timestamps until 2038 (0x7fffffff) [pid 296] restart_syscall(<... resuming interrupted clone ...> [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 593] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 299] rmdir("./9" [pid 296] <... restart_syscall resumed>) = 0 [pid 294] unlink("./9/bus" [pid 593] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 299] <... rmdir resumed>) = 0 [pid 297] ioctl(3, LOOP_CLR_FD [pid 294] <... unlink resumed>) = 0 [pid 593] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 299] mkdir("./10", 0777 [pid 294] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 593] <... mprotect resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 599 attached [pid 593] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] close(3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./9/binderfs", [pid 599] set_robust_list(0x7f0c4a20e9a0, 24 [pid 593] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] <... openat resumed>) = 3 [pid 296] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 593] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] <... close resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 294] unlink("./9/binderfs" [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] newfstatat(3, "", [pid 294] <... unlink resumed>) = 0 [pid 593] <... clone3 resumed> => {parent_tid=[601]}, 88) = 601 [pid 299] close(3 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 593] rt_sigprocmask(SIG_SETMASK, [], [pid 299] <... close resumed>) = 0 [pid 296] getdents64(3, [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 593] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 294] newfstatat(AT_FDCWD, "./9/file1", [pid 593] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 593] <... futex resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 602 [pid 294] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 593] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 294] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 294] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 294] close(4) = 0 [pid 294] rmdir("./9/file1" [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] <... umount2 resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [pid 599] <... set_robust_list resumed>) = 0 [pid 296] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] getdents64(3, [pid 599] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 599] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 603 [pid 296] newfstatat(AT_FDCWD, "./9/bus", [pid 294] close(3 [pid 599] memfd_create("syzkaller", 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... close resumed>) = 0 [pid 599] <... memfd_create resumed>) = 3 [pid 296] unlink("./9/bus" [pid 294] rmdir("./9"./strace-static-x86_64: Process 602 attached [pid 599] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 296] <... unlink resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 ./strace-static-x86_64: Process 601 attached [pid 602] set_robust_list(0x555556d8d6a0, 24 [pid 296] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] mkdir("./10", 0777 [pid 602] <... set_robust_list resumed>) = 0 [pid 601] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... mkdir resumed>) = 0 [pid 602] chdir("./10" [pid 601] <... set_robust_list resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./9/binderfs", [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 602] <... chdir resumed>) = 0 [pid 601] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... openat resumed>) = 3 [pid 602] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 601] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] unlink("./9/binderfs" [pid 294] ioctl(3, LOOP_CLR_FD./strace-static-x86_64: Process 603 attached [pid 602] <... prctl resumed>) = 0 [pid 601] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 599] <... mmap resumed>) = 0x7f0c41dcd000 [pid 296] <... unlink resumed>) = 0 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 603] set_robust_list(0x555556d8d6a0, 24 [pid 602] setpgid(0, 0 [pid 601] <... open resumed>) = 4 [pid 599] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 296] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 604 [pid 603] <... set_robust_list resumed>) = 0 [pid 602] <... setpgid resumed>) = 0 [pid 601] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] <... write resumed>) = 262144 [pid 602] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 602] write(3, "1000", 4) = 4 [pid 603] chdir("./10" [pid 602] close(3 [pid 601] <... futex resumed>) = 1 [pid 599] munmap(0x7f0c41dcd000, 138412032 [pid 593] <... futex resumed>) = 0 [pid 603] <... chdir resumed>) = 0 [pid 602] <... close resumed>) = 0 [pid 601] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 599] <... munmap resumed>) = 0 [pid 593] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 602] symlink("/dev/binderfs", "./binderfs" [pid 601] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 599] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 593] <... futex resumed>) = 0 ./strace-static-x86_64: Process 604 attached [pid 603] <... prctl resumed>) = 0 [pid 602] <... symlink resumed>) = 0 [pid 601] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 599] <... openat resumed>) = 5 [pid 593] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 604] set_robust_list(0x555556d8d6a0, 24 [pid 603] setpgid(0, 0 [pid 602] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 601] <... mount resumed>) = 0 [ 25.586284][ T592] EXT4-fs (loop1): 1 orphan inode deleted [ 25.598276][ T592] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 25.609354][ T592] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/9/file1 supports timestamps until 2038 (0x7fffffff) [pid 599] ioctl(5, LOOP_SET_FD, 3 [pid 604] <... set_robust_list resumed>) = 0 [pid 603] <... setpgid resumed>) = 0 [pid 602] <... futex resumed>) = 0 [pid 601] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 592] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 604] chdir("./10" [pid 603] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 602] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 601] <... futex resumed>) = 1 [pid 593] <... futex resumed>) = 0 [pid 604] <... chdir resumed>) = 0 [pid 603] <... openat resumed>) = 3 [pid 602] <... rt_sigaction resumed>NULL, 8) = 0 [pid 601] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 593] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 592] ioctl(5, LOOP_CLR_FD [pid 604] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 603] write(3, "1000", 4 [pid 602] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 601] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 593] <... futex resumed>) = 0 [pid 604] <... prctl resumed>) = 0 [pid 603] <... write resumed>) = 4 [pid 602] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 601] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 599] <... ioctl resumed>) = 0 [pid 593] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 604] setpgid(0, 0 [pid 603] close(3 [pid 602] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 601] <... open resumed>) = 6 [pid 604] <... setpgid resumed>) = 0 [pid 603] <... close resumed>) = 0 [pid 602] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 601] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] close(3 [pid 604] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 603] symlink("/dev/binderfs", "./binderfs" [pid 602] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 601] <... futex resumed>) = 1 [pid 599] <... close resumed>) = 0 [pid 593] <... futex resumed>) = 0 [pid 604] <... openat resumed>) = 3 [pid 603] <... symlink resumed>) = 0 [pid 602] <... mprotect resumed>) = 0 [pid 601] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 599] mkdir("./bus", 0777 [pid 593] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 604] write(3, "1000", 4 [pid 603] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] rt_sigprocmask(SIG_BLOCK, ~[], [pid 601] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 593] <... futex resumed>) = 0 [pid 604] <... write resumed>) = 4 [pid 603] <... futex resumed>) = 0 [pid 602] <... rt_sigprocmask resumed>[], 8) = 0 [pid 601] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 593] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 599] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 604] close(3 [pid 603] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 602] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 601] <... write resumed>) = 8 [pid 604] <... close resumed>) = 0 [pid 603] <... rt_sigaction resumed>NULL, 8) = 0 [pid 601] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 599] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 605 attached [pid 604] symlink("/dev/binderfs", "./binderfs" [pid 603] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 602] <... clone3 resumed> => {parent_tid=[605]}, 88) = 605 [pid 601] <... futex resumed>) = 1 [pid 593] <... futex resumed>) = 0 [pid 603] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 602] rt_sigprocmask(SIG_SETMASK, [], [pid 601] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 593] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 604] <... symlink resumed>) = 0 [pid 603] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 602] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 601] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 593] <... futex resumed>) = 0 [pid 603] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 602] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 601] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 593] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 604] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 602] <... futex resumed>) = 0 [pid 601] <... write resumed>) = 1045 [pid 605] set_robust_list(0x7f0c4a20e9a0, 24 [pid 604] <... futex resumed>) = 0 [pid 605] <... set_robust_list resumed>) = 0 [pid 604] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 605] rt_sigprocmask(SIG_SETMASK, [], [pid 604] <... rt_sigaction resumed>NULL, 8) = 0 [pid 605] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 604] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 605] memfd_create("syzkaller", 0 [pid 604] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 605] <... memfd_create resumed>) = 3 [pid 604] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 605] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 604] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 604] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 603] <... mprotect resumed>) = 0 [pid 602] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 601] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 605] <... mmap resumed>) = 0x7f0c41dee000 [pid 604] <... mprotect resumed>) = 0 [pid 603] rt_sigprocmask(SIG_BLOCK, ~[], [pid 602] <... futex resumed>) = 0 [pid 601] <... futex resumed>) = 1 [pid 599] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 593] <... futex resumed>) = 0 [pid 604] rt_sigprocmask(SIG_BLOCK, ~[], [pid 603] <... rt_sigprocmask resumed>[], 8) = 0 [pid 602] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 601] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 599] ioctl(5, LOOP_CLR_FD [pid 604] <... rt_sigprocmask resumed>[], 8) = 0 [pid 603] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 602] <... mmap resumed>) = 0x7f0c41dcd000 [pid 604] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 602] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 599] <... ioctl resumed>) = 0 ./strace-static-x86_64: Process 606 attached [pid 603] <... clone3 resumed> => {parent_tid=[606]}, 88) = 606 [pid 602] <... mprotect resumed>) = 0 ./strace-static-x86_64: Process 607 attached [pid 606] set_robust_list(0x7f0c4a20e9a0, 24 [pid 605] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 604] <... clone3 resumed> => {parent_tid=[607]}, 88) = 607 [pid 603] rt_sigprocmask(SIG_SETMASK, [], [pid 602] rt_sigprocmask(SIG_BLOCK, ~[], [pid 599] close(5 [pid 604] rt_sigprocmask(SIG_SETMASK, [], [pid 603] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 602] <... rt_sigprocmask resumed>[], 8) = 0 [pid 599] <... close resumed>) = 0 [pid 603] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 599] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 604] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 604] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] <... futex resumed>) = 0 [pid 599] <... futex resumed>) = 0 [pid 296] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 604] <... futex resumed>) = 0 [pid 603] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] <... clone3 resumed> => {parent_tid=[608]}, 88) = 608 [pid 599] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 603] <... futex resumed>) = 0 [pid 602] rt_sigprocmask(SIG_SETMASK, [], [pid 296] newfstatat(AT_FDCWD, "./9/file1", [pid 603] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 602] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 603] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 602] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 604] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 602] <... futex resumed>) = 0 [pid 593] exit_group(0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 604] <... futex resumed>) = 0 [pid 603] <... mprotect resumed>) = 0 [pid 602] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] openat(AT_FDCWD, "./9/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 603] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] <... openat resumed>) = 4 [pid 603] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] newfstatat(4, "", [pid 604] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 603] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 601] <... futex resumed>) = ? [pid 599] <... futex resumed>) = ? [pid 593] <... exit_group resumed>) = ? [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 604] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 601] +++ exited with 0 +++ [pid 599] +++ exited with 0 +++ [pid 592] <... ioctl resumed>) = 0 [pid 296] getdents64(4, [pid 603] <... clone3 resumed> => {parent_tid=[609]}, 88) = 609 [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 604] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 603] rt_sigprocmask(SIG_SETMASK, [], [pid 592] close(5 [pid 296] getdents64(4, [pid 604] <... mprotect resumed>) = 0 [pid 603] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 592] <... close resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 608 attached [pid 604] rt_sigprocmask(SIG_BLOCK, ~[], [pid 603] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 592] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 589] exit_group(0 [pid 296] close(4 [pid 608] set_robust_list(0x7f0c41ded9a0, 24 [pid 604] <... rt_sigprocmask resumed>[], 8) = 0 [pid 603] <... futex resumed>) = 0 [pid 594] <... futex resumed>) = ? [pid 592] <... futex resumed>) = ? [pid 589] <... exit_group resumed>) = ? [pid 296] <... close resumed>) = 0 ./strace-static-x86_64: Process 609 attached [pid 608] <... set_robust_list resumed>) = 0 [pid 607] set_robust_list(0x7f0c4a20e9a0, 24 [pid 606] <... set_robust_list resumed>) = 0 [pid 605] <... write resumed>) = 262144 [pid 604] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 603] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 594] +++ exited with 0 +++ [pid 592] +++ exited with 0 +++ [pid 589] +++ exited with 0 +++ [pid 296] rmdir("./9/file1" [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=589, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- ./strace-static-x86_64: Process 610 attached [pid 609] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 608] rt_sigprocmask(SIG_SETMASK, [], [pid 607] <... set_robust_list resumed>) = 0 [pid 606] rt_sigprocmask(SIG_SETMASK, [], [pid 605] munmap(0x7f0c41dee000, 138412032 [pid 610] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 609] <... set_robust_list resumed>) = 0 [pid 608] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 607] rt_sigprocmask(SIG_SETMASK, [], [pid 606] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 605] <... munmap resumed>) = 0 [pid 604] <... clone3 resumed> => {parent_tid=[610]}, 88) = 610 [pid 296] <... rmdir resumed>) = 0 [pid 609] rt_sigprocmask(SIG_SETMASK, [], [pid 608] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 607] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 606] memfd_create("syzkaller", 0 [pid 605] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 604] rt_sigprocmask(SIG_SETMASK, [], [pid 296] getdents64(3, [pid 610] <... set_robust_list resumed>) = 0 [pid 609] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 608] <... open resumed>) = 4 [pid 607] memfd_create("syzkaller", 0 [pid 606] <... memfd_create resumed>) = 3 [pid 605] <... openat resumed>) = 5 [pid 604] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 609] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 608] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 607] <... memfd_create resumed>) = 3 [pid 606] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [ 25.632000][ T599] loop4: detected capacity change from 0 to 512 [ 25.646245][ T599] EXT4-fs (loop4): fragment/cluster size (0) != block size (4096) [pid 605] ioctl(5, LOOP_SET_FD, 3 [pid 604] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] close(3 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 610] rt_sigprocmask(SIG_SETMASK, [], [pid 609] <... open resumed>) = 4 [pid 608] <... futex resumed>) = 1 [pid 607] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 606] <... mmap resumed>) = 0x7f0c41dcd000 [pid 602] <... futex resumed>) = 0 [pid 296] <... close resumed>) = 0 [pid 295] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 610] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 608] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 602] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] rmdir("./9" [pid 295] <... openat resumed>) = 3 [pid 610] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 608] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 602] <... futex resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 295] newfstatat(3, "", [pid 610] <... open resumed>) = 4 [pid 608] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 602] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] mkdir("./10", 0777 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 610] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 608] <... mount resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 295] getdents64(3, [pid 610] <... futex resumed>) = 0 [pid 608] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 610] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 608] <... futex resumed>) = 1 [pid 604] <... futex resumed>) = 0 [pid 602] <... futex resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 608] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 607] <... mmap resumed>) = 0x7f0c41dcd000 [pid 604] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 602] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 608] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 604] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 602] <... futex resumed>) = 0 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] newfstatat(AT_FDCWD, "./9/binderfs", [pid 608] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 604] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 602] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] close(3 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 610] <... futex resumed>) = 0 [pid 604] <... futex resumed>) = 1 [pid 296] <... close resumed>) = 0 [pid 295] unlink("./9/binderfs" [pid 610] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 609] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 607] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 606] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 605] <... ioctl resumed>) = 0 [pid 604] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... unlink resumed>) = 0 [pid 610] <... mount resumed>) = 0 [pid 609] <... futex resumed>) = 1 [pid 608] <... open resumed>) = 6 [pid 607] <... write resumed>) = 262144 [pid 605] close(3 [pid 603] <... futex resumed>) = 0 [pid 609] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 607] munmap(0x7f0c41dcd000, 138412032 [pid 608] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 607] <... munmap resumed>) = 0 [pid 605] <... close resumed>) = 0 [pid 603] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] umount2("./9/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 609] <... futex resumed>) = 0 [pid 608] <... futex resumed>) = 1 [pid 607] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 605] mkdir("./bus", 0777 [pid 603] <... futex resumed>) = 1 [pid 602] <... futex resumed>) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 611 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 609] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 608] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 607] <... openat resumed>) = 5 [pid 603] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 602] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] <... mount resumed>) = 0 [pid 608] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 607] ioctl(5, LOOP_SET_FD, 3 [pid 605] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 602] <... futex resumed>) = 0 [pid 295] newfstatat(AT_FDCWD, "./9/file1", ./strace-static-x86_64: Process 611 attached [pid 610] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 608] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 607] <... ioctl resumed>) = 0 [pid 606] <... write resumed>) = 262144 [pid 605] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 602] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 611] set_robust_list(0x555556d8d6a0, 24 [pid 610] <... futex resumed>) = 1 [pid 608] <... write resumed>) = 8 [pid 606] munmap(0x7f0c41dcd000, 138412032 [pid 604] <... futex resumed>) = 0 [pid 593] +++ exited with 0 +++ [pid 295] unlink("./9/file1" [pid 611] <... set_robust_list resumed>) = 0 [pid 610] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 608] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 606] <... munmap resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 611] chdir("./10" [pid 608] <... futex resumed>) = 1 [pid 606] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 602] <... futex resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=593, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 295] getdents64(3, [pid 611] <... chdir resumed>) = 0 [pid 608] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 606] <... openat resumed>) = 5 [pid 602] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./9", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 611] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 608] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 606] ioctl(5, LOOP_SET_FD, 3 [pid 602] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] close(3 [pid 611] <... prctl resumed>) = 0 [pid 609] <... futex resumed>) = 1 [pid 608] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 604] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] <... futex resumed>) = 0 [pid 602] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] openat(AT_FDCWD, "./9", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... close resumed>) = 0 [pid 611] setpgid(0, 0 [pid 610] <... futex resumed>) = 0 [pid 609] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 608] <... write resumed>) = 1045 [pid 606] <... ioctl resumed>) = 0 [pid 604] <... futex resumed>) = 1 [pid 603] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... openat resumed>) = 3 [pid 295] rmdir("./9" [pid 611] <... setpgid resumed>) = 0 [pid 610] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 609] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 608] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 606] close(3 [pid 604] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 603] <... futex resumed>) = 0 [pid 298] newfstatat(3, "", [pid 295] <... rmdir resumed>) = 0 [pid 611] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 610] <... open resumed>) = 6 [pid 608] <... futex resumed>) = 1 [pid 606] <... close resumed>) = 0 [pid 602] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] mkdir("./10", 0777 [pid 611] <... openat resumed>) = 3 [pid 610] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 608] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 606] mkdir("./bus", 0777 [pid 604] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 603] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] getdents64(3, [pid 295] <... mkdir resumed>) = 0 [pid 611] write(3, "1000", 4 [pid 610] <... futex resumed>) = 0 [pid 606] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 611] <... write resumed>) = 4 [pid 610] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 606] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 298] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... openat resumed>) = 3 [pid 611] close(3 [pid 609] <... open resumed>) = 3 [pid 604] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... umount2 resumed>) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 611] <... close resumed>) = 0 [pid 610] <... futex resumed>) = 0 [pid 609] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 604] <... futex resumed>) = 1 [pid 298] umount2("./9/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 611] symlink("/dev/binderfs", "./binderfs" [pid 610] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 609] <... futex resumed>) = 1 [pid 604] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 603] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] close(3 [pid 611] <... symlink resumed>) = 0 [pid 610] <... write resumed>) = 8 [pid 609] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 603] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(AT_FDCWD, "./9/bus", [pid 295] <... close resumed>) = 0 [pid 611] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 610] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 603] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 611] <... futex resumed>) = 0 [pid 610] <... futex resumed>) = 1 [pid 609] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 604] <... futex resumed>) = 0 [pid 603] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] unlink("./9/bus" [pid 611] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 610] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 609] <... write resumed>) = 8 [pid 607] close(3 [pid 604] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... unlink resumed>) = 0 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 613 [pid 611] <... rt_sigaction resumed>NULL, 8) = 0 [pid 610] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 609] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 607] <... close resumed>) = 0 [pid 604] <... futex resumed>) = 0 [pid 298] umount2("./9/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 611] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 610] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 609] <... futex resumed>) = 1 [pid 607] mkdir("./bus", 0777 [pid 604] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 603] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 611] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 610] <... write resumed>) = 1045 [pid 609] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 607] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 603] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] newfstatat(AT_FDCWD, "./9/binderfs", ./strace-static-x86_64: Process 613 attached [pid 611] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 610] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 609] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 607] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 603] <... futex resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 611] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 610] <... futex resumed>) = 1 [pid 609] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 604] <... futex resumed>) = 0 [ 25.677979][ T605] loop5: detected capacity change from 0 to 512 [ 25.691516][ T607] loop0: detected capacity change from 0 to 512 [ 25.705288][ T606] loop3: detected capacity change from 0 to 512 [ 25.717229][ T605] EXT4-fs (loop5): Invalid log block size: 2475723007 [pid 603] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] unlink("./9/binderfs" [pid 611] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 610] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 609] <... write resumed>) = 1045 [pid 298] <... unlink resumed>) = 0 [pid 611] <... mprotect resumed>) = 0 [pid 298] getdents64(3, [pid 611] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 611] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] close(3 [pid 611] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 298] <... close resumed>) = 0 [pid 298] rmdir("./9" [pid 611] <... clone3 resumed> => {parent_tid=[615]}, 88) = 615 [pid 298] <... rmdir resumed>) = 0 [pid 611] rt_sigprocmask(SIG_SETMASK, [], [pid 298] mkdir("./10", 0777 [pid 611] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] <... mkdir resumed>) = 0 [pid 611] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 611] <... futex resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 611] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] ioctl(3, LOOP_CLR_FD [pid 611] <... futex resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 611] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 609] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 611] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 298] <... close resumed>) = 0 [pid 611] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 609] <... futex resumed>) = 1 [pid 603] <... futex resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 611] <... mprotect resumed>) = 0 [pid 609] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 611] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 616 ./strace-static-x86_64: Process 615 attached [pid 613] set_robust_list(0x555556d8d6a0, 24 [pid 611] <... rt_sigprocmask resumed>[], 8) = 0 ./strace-static-x86_64: Process 616 attached [pid 615] set_robust_list(0x7f0c4a20e9a0, 24 [pid 613] <... set_robust_list resumed>) = 0 [pid 611] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 607] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 605] <... mount resumed>) = -1 EINVAL (Invalid argument) ./strace-static-x86_64: Process 617 attached [pid 616] set_robust_list(0x555556d8d6a0, 24 [pid 615] <... set_robust_list resumed>) = 0 [pid 613] chdir("./10" [pid 607] ioctl(5, LOOP_CLR_FD [pid 605] ioctl(5, LOOP_CLR_FD [pid 617] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 616] <... set_robust_list resumed>) = 0 [pid 615] rt_sigprocmask(SIG_SETMASK, [], [pid 613] <... chdir resumed>) = 0 [pid 611] <... clone3 resumed> => {parent_tid=[617]}, 88) = 617 [pid 607] <... ioctl resumed>) = 0 [pid 605] <... ioctl resumed>) = 0 [pid 617] <... set_robust_list resumed>) = 0 [pid 616] chdir("./10" [pid 615] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 613] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 611] rt_sigprocmask(SIG_SETMASK, [], [pid 607] close(5 [pid 605] close(5 [pid 616] <... chdir resumed>) = 0 [pid 615] memfd_create("syzkaller", 0 [pid 613] <... prctl resumed>) = 0 [pid 611] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 607] <... close resumed>) = 0 [pid 615] <... memfd_create resumed>) = 3 [pid 611] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 615] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 611] <... futex resumed>) = 0 [pid 615] <... mmap resumed>) = 0x7f0c41dcd000 [pid 611] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 615] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 615] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 615] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 4 [pid 615] ioctl(4, LOOP_SET_FD, 3 [pid 616] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 613] setpgid(0, 0 [pid 607] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 605] <... close resumed>) = 0 [pid 616] <... prctl resumed>) = 0 [pid 613] <... setpgid resumed>) = 0 [pid 607] <... futex resumed>) = 0 [pid 605] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 604] exit_group(0 [pid 616] setpgid(0, 0 [pid 613] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 604] <... exit_group resumed>) = ? [pid 610] <... futex resumed>) = ? [pid 605] <... futex resumed>) = 0 [pid 616] <... setpgid resumed>) = 0 [pid 613] <... openat resumed>) = 3 [pid 610] +++ exited with 0 +++ [pid 607] +++ exited with 0 +++ [pid 615] <... ioctl resumed>) = 0 [pid 615] close(3) = 0 [pid 615] mkdir("./file1", 0777 [pid 602] exit_group(0 [pid 608] <... futex resumed>) = ? [pid 602] <... exit_group resumed>) = ? [pid 616] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 608] +++ exited with 0 +++ [pid 616] <... openat resumed>) = 3 [pid 613] write(3, "1000", 4 [pid 616] write(3, "1000", 4 [pid 615] <... mkdir resumed>) = 0 [pid 615] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 617] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 617] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 617] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 611] <... futex resumed>) = 0 [pid 611] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 611] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 617] <... futex resumed>) = 1 [pid 617] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL) = 0 [pid 617] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 611] <... futex resumed>) = 0 [pid 611] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 611] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 617] <... futex resumed>) = 1 [pid 617] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 617] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 611] <... futex resumed>) = 0 [pid 611] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 611] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 617] <... futex resumed>) = 1 [pid 617] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 613] <... write resumed>) = 4 [pid 616] <... write resumed>) = 4 [pid 613] close(3 [pid 616] close(3 [pid 613] <... close resumed>) = 0 [pid 616] <... close resumed>) = 0 [pid 613] symlink("/dev/binderfs", "./binderfs" [pid 616] symlink("/dev/binderfs", "./binderfs" [pid 613] <... symlink resumed>) = 0 [pid 616] <... symlink resumed>) = 0 [pid 613] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 616] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] <... futex resumed>) = 0 [pid 616] <... futex resumed>) = 0 [pid 613] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 616] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 613] <... rt_sigaction resumed>NULL, 8) = 0 [pid 616] <... rt_sigaction resumed>NULL, 8) = 0 [pid 613] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 616] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 613] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 616] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 613] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 616] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 613] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 616] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 613] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 616] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 613] <... mprotect resumed>) = 0 [pid 616] <... mprotect resumed>) = 0 [pid 613] rt_sigprocmask(SIG_BLOCK, ~[], [pid 616] rt_sigprocmask(SIG_BLOCK, ~[], [pid 613] <... rt_sigprocmask resumed>[], 8) = 0 [pid 616] <... rt_sigprocmask resumed>[], 8) = 0 [pid 613] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 616] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 605] +++ exited with 0 +++ [pid 602] +++ exited with 0 +++ [pid 613] <... clone3 resumed> => {parent_tid=[618]}, 88) = 618 [pid 616] <... clone3 resumed> => {parent_tid=[619]}, 88) = 619 [pid 613] rt_sigprocmask(SIG_SETMASK, [], [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=602, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 616] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 299] restart_syscall(<... resuming interrupted clone ...> [pid 613] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 616] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... restart_syscall resumed>) = 0 [pid 613] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 616] <... futex resumed>) = 0 [pid 613] <... futex resumed>) = 0 [pid 616] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 613] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 616] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 613] <... futex resumed>) = 0 [pid 299] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 616] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 613] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 616] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 613] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 299] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 616] <... mprotect resumed>) = 0 [pid 613] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 299] <... openat resumed>) = 3 [pid 613] <... mprotect resumed>) = 0 [pid 299] newfstatat(3, "", [pid 616] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 613] rt_sigprocmask(SIG_BLOCK, ~[], [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 616] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 613] <... rt_sigprocmask resumed>[], 8) = 0 [pid 299] getdents64(3, [pid 613] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 616] <... clone3 resumed> => {parent_tid=[620]}, 88) = 620 [pid 613] <... clone3 resumed> => {parent_tid=[621]}, 88) = 621 [pid 616] rt_sigprocmask(SIG_SETMASK, [], [pid 299] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 613] rt_sigprocmask(SIG_SETMASK, [], [pid 616] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 616] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 299] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 616] <... futex resumed>) = 0 [pid 613] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 616] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 613] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./10/bus", [pid 613] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./10/bus"./strace-static-x86_64: Process 621 attached ) = 0 [pid 299] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 617] <... write resumed>) = 8 [pid 299] newfstatat(AT_FDCWD, "./10/binderfs", [pid 621] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 617] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [ 25.735184][ T607] EXT4-fs (loop0): Invalid log block size: 2475723007 [ 25.747105][ T606] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 25.766909][ T615] loop2: detected capacity change from 0 to 512 [ 25.775643][ T606] EXT4-fs (loop3): get root inode failed [pid 299] unlink("./10/binderfs"./strace-static-x86_64: Process 620 attached ./strace-static-x86_64: Process 619 attached ./strace-static-x86_64: Process 618 attached [pid 617] <... futex resumed>) = 1 [pid 611] <... futex resumed>) = 0 [pid 604] +++ exited with 0 +++ [pid 299] <... unlink resumed>) = 0 [pid 621] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 621] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 621] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 621] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 620] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 619] set_robust_list(0x7f0c4a20e9a0, 24 [pid 618] set_robust_list(0x7f0c4a20e9a0, 24 [pid 617] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 613] <... futex resumed>) = 0 [pid 611] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] getdents64(3, [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=604, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 620] <... set_robust_list resumed>) = 0 [pid 620] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 620] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 620] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 620] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 619] <... set_robust_list resumed>) = 0 [pid 619] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 619] memfd_create("syzkaller", 0) = 4 [pid 618] <... set_robust_list resumed>) = 0 [pid 617] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 613] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 611] <... futex resumed>) = 0 [pid 616] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 619] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 619] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 619] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 619] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 5 [pid 619] ioctl(5, LOOP_SET_FD, 4 [pid 621] <... futex resumed>) = 0 [pid 618] rt_sigprocmask(SIG_SETMASK, [], [pid 617] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 616] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] <... futex resumed>) = 1 [pid 611] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 606] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 299] close(3 [pid 619] <... ioctl resumed>) = 0 [pid 619] close(4) = 0 [pid 619] mkdir("./file1", 0777) = 0 [pid 619] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 621] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 621] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 621] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 618] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 618] memfd_create("syzkaller", 0) = 4 [pid 618] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 [pid 618] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 618] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 618] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 5 [pid 618] ioctl(5, LOOP_SET_FD, 4 [pid 616] <... futex resumed>) = 1 [pid 613] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 606] ioctl(5, LOOP_CLR_FD [pid 299] <... close resumed>) = 0 [pid 294] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 620] <... futex resumed>) = 0 [pid 613] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 606] <... ioctl resumed>) = 0 [pid 620] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 616] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 613] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 606] close(5 [pid 299] rmdir("./10" [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 620] <... mount resumed>) = 0 [pid 613] <... futex resumed>) = 1 [pid 621] <... futex resumed>) = 0 [pid 620] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 617] <... write resumed>) = 1045 [pid 615] <... mount resumed>) = 0 [pid 613] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 606] <... close resumed>) = 0 [pid 299] <... rmdir resumed>) = 0 [pid 294] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 621] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 620] <... futex resumed>) = 1 [pid 617] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 606] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 616] <... futex resumed>) = 0 [pid 299] mkdir("./11", 0777 [pid 617] <... futex resumed>) = 1 [pid 294] <... openat resumed>) = 3 [pid 606] <... futex resumed>) = 0 [pid 611] <... futex resumed>) = 0 [pid 621] <... open resumed>) = 6 [pid 616] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 603] exit_group(0 [pid 617] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... mkdir resumed>) = 0 [pid 621] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 620] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 616] <... futex resumed>) = 0 [pid 609] <... futex resumed>) = ? [pid 603] <... exit_group resumed>) = ? [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 294] newfstatat(3, "", [pid 616] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 609] +++ exited with 0 +++ [pid 606] +++ exited with 0 +++ [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 25.792907][ T606] EXT4-fs (loop3): mount failed [ 25.799501][ T615] EXT4-fs (loop2): 1 orphan inode deleted [ 25.805626][ T615] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 25.810298][ T619] loop4: detected capacity change from 0 to 512 [ 25.817956][ T615] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/10/file1 supports timestamps until 2038 (0x7fffffff) [pid 621] <... futex resumed>) = 1 [pid 620] <... open resumed>) = 4 [pid 613] <... futex resumed>) = 0 [pid 603] +++ exited with 0 +++ [pid 294] getdents64(3, [pid 615] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 621] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 620] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 618] <... ioctl resumed>) = 0 [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=603, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 613] <... futex resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 618] close(4 [pid 621] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 613] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 620] <... futex resumed>) = 1 [pid 616] <... futex resumed>) = 0 [pid 294] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 621] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 299] <... openat resumed>) = 3 [pid 616] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 620] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 616] <... futex resumed>) = 0 [pid 294] <... umount2 resumed>) = 0 [pid 297] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 616] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 621] <... write resumed>) = 8 [pid 620] <... write resumed>) = 8 [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] <... openat resumed>) = 3 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 621] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 620] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 618] <... close resumed>) = 0 [pid 618] mkdir("./file1", 0777) = 0 [pid 618] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 621] <... futex resumed>) = 1 [pid 620] <... futex resumed>) = 1 [pid 616] <... futex resumed>) = 0 [pid 613] <... futex resumed>) = 0 [pid 299] close(3 [pid 297] newfstatat(3, "", [pid 294] newfstatat(AT_FDCWD, "./10/bus", [pid 621] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 620] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 616] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 621] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 620] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 616] <... futex resumed>) = 0 [pid 613] <... futex resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] getdents64(3, [pid 294] unlink("./10/bus" [pid 621] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 620] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 616] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 613] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] <... unlink resumed>) = 0 [pid 297] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 621] <... write resumed>) = 1045 [pid 621] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 620] <... write resumed>) = 1045 [pid 297] <... umount2 resumed>) = 0 [pid 621] <... futex resumed>) = 1 [pid 620] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 613] <... futex resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 625 [pid 297] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 621] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 620] <... futex resumed>) = 1 [pid 616] <... futex resumed>) = 0 [pid 297] newfstatat(AT_FDCWD, "./10/bus", [pid 620] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] newfstatat(AT_FDCWD, "./10/binderfs", [pid 297] unlink("./10/bus" [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... unlink resumed>) = 0 [pid 294] unlink("./10/binderfs") = 0 [pid 297] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] getdents64(3, [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] newfstatat(AT_FDCWD, "./10/binderfs", [pid 294] close(3 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... close resumed>) = 0 [pid 615] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 615] ioctl(4, LOOP_CLR_FD) = 0 [pid 615] close(4) = 0 [pid 615] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 615] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 625 attached [pid 625] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 625] chdir("./11") = 0 [pid 625] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 625] setpgid(0, 0) = 0 [pid 625] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 625] write(3, "1000", 4) = 4 [pid 625] close(3) = 0 [pid 625] symlink("/dev/binderfs", "./binderfs") = 0 [pid 625] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 625] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 625] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 625] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 611] exit_group(0 [pid 297] unlink("./10/binderfs" [pid 294] rmdir("./10" [pid 617] <... futex resumed>) = ? [pid 615] <... futex resumed>) = ? [pid 611] <... exit_group resumed>) = ? [pid 617] +++ exited with 0 +++ [pid 297] <... unlink resumed>) = 0 [pid 625] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 294] <... rmdir resumed>) = 0 [pid 297] getdents64(3, [pid 294] mkdir("./11", 0777 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 297] close(3) = 0 [pid 297] rmdir("./10") = 0 [pid 297] mkdir("./11", 0777) = 0 [pid 618] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 615] +++ exited with 0 +++ [pid 611] +++ exited with 0 +++ [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=611, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 294] <... openat resumed>) = 3 [pid 294] ioctl(3, LOOP_CLR_FD [pid 618] ioctl(5, LOOP_CLR_FD [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 618] <... ioctl resumed>) = 0 [pid 296] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] close(3 [pid 618] close(5 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... close resumed>) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 618] <... close resumed>) = 0 [pid 296] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 618] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... openat resumed>) = 3 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 627 [pid 618] <... futex resumed>) = 0 [pid 296] newfstatat(3, "", [pid 618] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 613] exit_group(0 [pid 296] getdents64(3, [pid 625] <... mprotect resumed>) = 0 [pid 621] <... futex resumed>) = ? [pid 618] <... futex resumed>) = ? [ 25.841095][ T618] loop1: detected capacity change from 0 to 512 [ 25.859441][ T618] EXT4-fs (loop1): Invalid log block size: 2475723007 [pid 613] <... exit_group resumed>) = ? [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 625] rt_sigprocmask(SIG_BLOCK, ~[], [pid 621] +++ exited with 0 +++ [pid 618] +++ exited with 0 +++ [pid 296] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 627 attached [pid 625] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 627] set_robust_list(0x555556d8d6a0, 24 [pid 625] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 296] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 627] <... set_robust_list resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 627] chdir("./11" [pid 625] <... clone3 resumed> => {parent_tid=[628]}, 88) = 628 [pid 296] newfstatat(AT_FDCWD, "./10/bus", [pid 627] <... chdir resumed>) = 0 [pid 625] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 627] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 625] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] unlink("./10/bus" [pid 627] <... prctl resumed>) = 0 [pid 625] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... unlink resumed>) = 0 [pid 627] setpgid(0, 0 [pid 625] <... futex resumed>) = 0 [pid 296] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 627] <... setpgid resumed>) = 0 [pid 625] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 627] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 625] <... futex resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./10/binderfs", [pid 627] <... openat resumed>) = 3 [pid 625] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 627] write(3, "1000", 4 [pid 625] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 296] unlink("./10/binderfs" [pid 627] <... write resumed>) = 4 [pid 625] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 296] <... unlink resumed>) = 0 [pid 627] close(3 [pid 625] <... mprotect resumed>) = 0 [pid 296] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 627] <... close resumed>) = 0 [pid 625] rt_sigprocmask(SIG_BLOCK, ~[], [pid 627] symlink("/dev/binderfs", "./binderfs" [pid 625] <... rt_sigprocmask resumed>[], 8) = 0 [pid 627] <... symlink resumed>) = 0 [pid 625] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 627] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 625] <... clone3 resumed> => {parent_tid=[629]}, 88) = 629 [pid 627] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 625] rt_sigprocmask(SIG_SETMASK, [], [pid 627] <... rt_sigaction resumed>NULL, 8) = 0 [pid 625] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] <... openat resumed>) = 3 [pid 627] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 625] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 627] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 625] <... futex resumed>) = 0 [pid 627] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 625] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 627] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 627] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 627] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 627] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[630]}, 88) = 630 [pid 627] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 627] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 627] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] ioctl(3, LOOP_CLR_FD [pid 627] <... futex resumed>) = 0 [pid 627] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 627] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 627] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 297] close(3 [pid 627] <... mprotect resumed>) = 0 [pid 627] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 297] <... close resumed>) = 0 [pid 627] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 627] <... clone3 resumed> => {parent_tid=[631]}, 88) = 631 [pid 627] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 627] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 627] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 632 attached [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 632 [pid 632] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 632] chdir("./11") = 0 [pid 632] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 632] setpgid(0, 0) = 0 ./strace-static-x86_64: Process 628 attached [pid 632] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 632] write(3, "1000", 4) = 4 [pid 632] close(3) = 0 [pid 632] symlink("/dev/binderfs", "./binderfs") = 0 [pid 632] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 632] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 632] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 632] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 632] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 632] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 632] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[633]}, 88) = 633 [pid 632] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 632] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 632] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 632] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 632] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 632] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 632] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[634]}, 88) = 634 [pid 632] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 632] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 632] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 633 attached [pid 633] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 633] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 633] memfd_create("syzkaller", 0) = 3 [pid 633] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dcd000 ./strace-static-x86_64: Process 634 attached ./strace-static-x86_64: Process 631 attached ./strace-static-x86_64: Process 630 attached ./strace-static-x86_64: Process 629 attached [pid 628] set_robust_list(0x7f0c4a20e9a0, 24 [pid 613] +++ exited with 0 +++ [pid 634] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 633] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 631] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 630] set_robust_list(0x7f0c4a20e9a0, 24 [pid 629] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 628] <... set_robust_list resumed>) = 0 [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=613, si_uid=0, si_status=0, si_utime=0, si_stime=0} --- [pid 631] <... set_robust_list resumed>) = 0 [pid 630] <... set_robust_list resumed>) = 0 [pid 629] <... set_robust_list resumed>) = 0 [pid 628] rt_sigprocmask(SIG_SETMASK, [], [pid 631] rt_sigprocmask(SIG_SETMASK, [], [pid 630] rt_sigprocmask(SIG_SETMASK, [], [pid 629] rt_sigprocmask(SIG_SETMASK, [], [pid 628] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 631] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 630] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 629] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 628] memfd_create("syzkaller", 0 [pid 631] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 630] memfd_create("syzkaller", 0 [pid 629] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 628] <... memfd_create resumed>) = 3 [pid 631] <... open resumed>) = 4 [pid 630] <... memfd_create resumed>) = 3 [pid 629] <... open resumed>) = 4 [pid 628] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 631] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 630] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 629] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 628] <... mmap resumed>) = 0x7f0c41dcd000 [pid 631] <... futex resumed>) = 1 [pid 630] <... mmap resumed>) = 0x7f0c41dcd000 [pid 629] <... futex resumed>) = 1 [pid 628] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 627] <... futex resumed>) = 0 [pid 625] <... futex resumed>) = 0 [pid 631] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 630] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 629] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 628] <... write resumed>) = 262144 [pid 627] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 625] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 630] <... write resumed>) = 262144 [pid 629] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 628] munmap(0x7f0c41dcd000, 138412032 [pid 634] <... set_robust_list resumed>) = 0 [pid 631] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 630] munmap(0x7f0c41dcd000, 138412032 [pid 629] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 628] <... munmap resumed>) = 0 [pid 627] <... futex resumed>) = 0 [pid 625] <... futex resumed>) = 0 [pid 634] rt_sigprocmask(SIG_SETMASK, [], [pid 631] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 630] <... munmap resumed>) = 0 [pid 629] <... mount resumed>) = 0 [pid 628] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 634] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 631] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 630] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 629] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 628] <... openat resumed>) = 5 [pid 627] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 625] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 634] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 631] <... futex resumed>) = 0 [pid 630] <... openat resumed>) = 5 [pid 629] <... futex resumed>) = 0 [pid 628] ioctl(5, LOOP_SET_FD, 3 [pid 627] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 625] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] <... umount2 resumed>) = 0 [pid 295] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 634] <... open resumed>) = 4 [pid 633] <... write resumed>) = 262144 [pid 631] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 630] ioctl(5, LOOP_SET_FD, 3 [pid 629] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 627] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 625] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 619] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 296] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 634] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 627] <... futex resumed>) = 0 [pid 625] <... futex resumed>) = 0 [pid 295] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 634] <... futex resumed>) = 1 [pid 632] <... futex resumed>) = 0 [pid 631] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 629] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 627] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 625] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 619] ioctl(5, LOOP_CLR_FD [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... openat resumed>) = 3 [pid 634] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 633] munmap(0x7f0c41dcd000, 138412032 [pid 632] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 629] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 619] <... ioctl resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./10/file1", [pid 295] newfstatat(3, "", [pid 634] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 633] <... munmap resumed>) = 0 [pid 632] <... futex resumed>) = 0 [pid 619] close(5 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 25.881354][ T619] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 25.895769][ T619] EXT4-fs (loop4): get root inode failed [ 25.905379][ T619] EXT4-fs (loop4): mount failed [ 25.932702][ T628] loop5: detected capacity change from 0 to 512 [pid 634] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 633] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 632] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 619] <... close resumed>) = 0 [pid 295] getdents64(3, [pid 634] <... mount resumed>) = 0 [pid 633] <... openat resumed>) = 5 [pid 619] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 634] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 633] ioctl(5, LOOP_SET_FD, 3 [pid 631] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 619] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 634] <... futex resumed>) = 1 [pid 632] <... futex resumed>) = 0 [pid 631] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 630] <... ioctl resumed>) = 0 [pid 629] <... open resumed>) = 6 [pid 628] <... ioctl resumed>) = 0 [pid 619] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 631] <... futex resumed>) = 1 [pid 630] close(3 [pid 629] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 628] close(3 [pid 616] exit_group(0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 631] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 630] <... close resumed>) = 0 [pid 629] <... futex resumed>) = 1 [pid 628] <... close resumed>) = 0 [pid 620] <... futex resumed>) = ? [pid 616] <... exit_group resumed>) = ? [pid 296] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 630] mkdir("./file1", 0777 [pid 629] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 628] mkdir("./bus", 0777 [pid 620] +++ exited with 0 +++ [pid 296] <... openat resumed>) = 4 [pid 630] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 628] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 296] newfstatat(4, "", [pid 630] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 628] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 634] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 633] <... ioctl resumed>) = 0 [pid 632] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 627] <... futex resumed>) = 0 [pid 625] <... futex resumed>) = 0 [pid 619] <... futex resumed>) = ? [pid 296] getdents64(4, [pid 295] <... umount2 resumed>) = 0 [pid 634] <... open resumed>) = 6 [pid 632] <... futex resumed>) = 0 [pid 627] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 625] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 295] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 296] close(4) = 0 [pid 296] rmdir("./10/file1" [pid 634] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 632] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 631] <... futex resumed>) = 0 [pid 629] <... futex resumed>) = 0 [pid 627] <... futex resumed>) = 1 [pid 625] <... futex resumed>) = 1 [pid 296] <... rmdir resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 631] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 629] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 296] getdents64(3, [pid 631] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 629] <... write resumed>) = 8 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 634] <... futex resumed>) = 0 [pid 632] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 631] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 629] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 627] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 625] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] close(3 [pid 295] newfstatat(AT_FDCWD, "./10/bus", [pid 634] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 632] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 631] <... futex resumed>) = 0 [pid 629] <... futex resumed>) = 0 [pid 627] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 625] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 296] <... close resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 634] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 632] <... futex resumed>) = 0 [pid 631] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 629] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 627] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 625] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] rmdir("./10" [pid 295] unlink("./10/bus" [pid 634] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 633] close(3 [pid 632] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 631] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 629] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 627] <... futex resumed>) = 0 [pid 625] <... futex resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 634] <... write resumed>) = 8 [pid 633] <... close resumed>) = 0 [pid 631] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 629] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 627] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 625] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 634] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 633] mkdir("./bus", 0777 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 634] <... futex resumed>) = 1 [pid 633] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 632] <... futex resumed>) = 0 [pid 295] newfstatat(AT_FDCWD, "./10/binderfs", [pid 634] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 633] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 632] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 634] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 632] <... futex resumed>) = 0 [pid 631] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 629] <... write resumed>) = 1045 [pid 296] mkdir("./11", 0777 [pid 295] unlink("./10/binderfs" [pid 634] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 632] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 295] <... unlink resumed>) = 0 [pid 634] <... write resumed>) = 1045 [pid 295] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 634] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 634] <... futex resumed>) = 1 [pid 632] <... futex resumed>) = 0 [pid 295] newfstatat(AT_FDCWD, "./10/file1", [pid 634] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4 [pid 295] newfstatat(4, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] getdents64(4, 0x555556d96770 /* 2 entries */, 32768) = 48 [pid 295] getdents64(4, 0x555556d96770 /* 0 entries */, 32768) = 0 [pid 295] close(4) = 0 [pid 295] rmdir("./10/file1") = 0 [pid 295] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] close(3) = 0 [pid 295] rmdir("./10") = 0 [pid 295] mkdir("./11", 0777 [pid 631] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 629] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 619] +++ exited with 0 +++ [pid 616] +++ exited with 0 +++ [pid 296] <... mkdir resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 631] <... futex resumed>) = 1 [pid 629] <... futex resumed>) = 1 [pid 627] <... futex resumed>) = 0 [pid 625] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 631] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 629] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=616, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [ 25.941114][ T630] loop0: detected capacity change from 0 to 512 [ 25.949131][ T633] loop3: detected capacity change from 0 to 512 [ 25.963940][ T630] EXT4-fs (loop0): 1 orphan inode deleted [ 25.970489][ T630] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 25.981718][ T630] ext4 filesystem being mounted at /root/syzkaller.iF59aB/11/file1 supports timestamps until 2038 (0x7fffffff) [pid 296] <... openat resumed>) = 3 [pid 295] <... openat resumed>) = 3 [pid 298] umount2("./10", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] ioctl(3, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 298] openat(AT_FDCWD, "./10", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 296] close(3 [pid 295] close(3 [pid 298] <... openat resumed>) = 3 [pid 296] <... close resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 298] newfstatat(3, "", [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 642 attached ./strace-static-x86_64: Process 641 attached [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 642] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 642] chdir("./11") = 0 [pid 642] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 642] setpgid(0, 0) = 0 [pid 642] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 642] write(3, "1000", 4) = 4 [pid 642] close(3) = 0 [pid 642] symlink("/dev/binderfs", "./binderfs") = 0 [pid 642] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] set_robust_list(0x555556d8d6a0, 24 [pid 298] getdents64(3, [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 641 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 642 [pid 642] <... futex resumed>) = 0 [pid 642] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 641] <... set_robust_list resumed>) = 0 [pid 642] <... rt_sigaction resumed>NULL, 8) = 0 [pid 641] chdir("./11" [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 641] <... chdir resumed>) = 0 [pid 642] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 641] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 630] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 298] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 641] <... prctl resumed>) = 0 [pid 642] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 641] setpgid(0, 0 [pid 630] ioctl(5, LOOP_CLR_FD [pid 641] <... setpgid resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 642] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 641] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 298] umount2("./10/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 628] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 642] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 641] <... openat resumed>) = 3 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 633] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 628] ioctl(5, LOOP_CLR_FD [pid 642] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 641] write(3, "1000", 4 [pid 298] newfstatat(AT_FDCWD, "./10/bus", [pid 642] <... mprotect resumed>) = 0 [pid 641] <... write resumed>) = 4 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 642] rt_sigprocmask(SIG_BLOCK, ~[], [pid 641] close(3 [pid 298] unlink("./10/bus" [pid 642] <... rt_sigprocmask resumed>[], 8) = 0 [pid 641] <... close resumed>) = 0 [pid 642] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 641] symlink("/dev/binderfs", "./binderfs" [pid 298] <... unlink resumed>) = 0 [pid 642] <... clone3 resumed> => {parent_tid=[643]}, 88) = 643 [pid 642] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 642] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 641] <... symlink resumed>) = 0 [pid 642] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./10/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 642] <... futex resumed>) = 0 [pid 641] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 642] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 641] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 298] newfstatat(AT_FDCWD, "./10/binderfs", [pid 642] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 641] <... rt_sigaction resumed>NULL, 8) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 ./strace-static-x86_64: Process 643 attached [pid 642] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 633] ioctl(5, LOOP_CLR_FD [pid 628] <... ioctl resumed>) = 0 [pid 642] <... mprotect resumed>) = 0 [pid 642] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 642] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 641] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 642] <... clone3 resumed> => {parent_tid=[644]}, 88) = 644 [pid 298] unlink("./10/binderfs" [pid 642] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 642] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 642] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 633] <... ioctl resumed>) = 0 [pid 633] close(5./strace-static-x86_64: Process 644 attached [pid 643] set_robust_list(0x7f0c4a20e9a0, 24 [pid 641] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 633] <... close resumed>) = 0 [pid 628] close(5 [pid 298] <... unlink resumed>) = 0 [pid 644] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 643] <... set_robust_list resumed>) = 0 [pid 641] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 628] <... close resumed>) = 0 [pid 298] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 644] <... set_robust_list resumed>) = 0 [pid 643] rt_sigprocmask(SIG_SETMASK, [], [pid 641] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 628] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 625] exit_group(0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 644] rt_sigprocmask(SIG_SETMASK, [], [pid 643] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 641] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 633] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 629] <... futex resumed>) = ? [pid 628] <... futex resumed>) = ? [pid 625] <... exit_group resumed>) = ? [pid 298] newfstatat(AT_FDCWD, "./10/file1", [pid 644] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 643] memfd_create("syzkaller", 0 [pid 641] <... mprotect resumed>) = 0 [pid 633] <... futex resumed>) = 0 [pid 632] exit_group(0 [pid 629] +++ exited with 0 +++ [pid 628] +++ exited with 0 +++ [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 644] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 643] <... memfd_create resumed>) = 3 [pid 641] rt_sigprocmask(SIG_BLOCK, ~[], [pid 634] <... futex resumed>) = ? [pid 632] <... exit_group resumed>) = ? [pid 298] umount2("./10/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 644] <... open resumed>) = 4 [pid 643] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 641] <... rt_sigprocmask resumed>[], 8) = 0 [pid 634] +++ exited with 0 +++ [pid 633] +++ exited with 0 +++ [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 644] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 643] <... mmap resumed>) = 0x7f0c41dcd000 [pid 641] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 298] openat(AT_FDCWD, "./10/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY./strace-static-x86_64: Process 645 attached [pid 644] <... futex resumed>) = 1 [pid 643] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 642] <... futex resumed>) = 0 [pid 298] <... openat resumed>) = 4 [pid 645] set_robust_list(0x7f0c4a20e9a0, 24 [pid 644] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 642] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] <... clone3 resumed> => {parent_tid=[645]}, 88) = 645 [pid 298] newfstatat(4, "", [pid 645] <... set_robust_list resumed>) = 0 [pid 644] <... mount resumed>) = 0 [pid 642] <... futex resumed>) = 0 [pid 641] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 645] rt_sigprocmask(SIG_SETMASK, [], [pid 644] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 643] <... write resumed>) = 262144 [pid 642] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 641] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] getdents64(4, [pid 644] <... futex resumed>) = 0 [pid 643] munmap(0x7f0c41dcd000, 138412032 [pid 642] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 641] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 645] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 644] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 643] <... munmap resumed>) = 0 [pid 642] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 644] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 643] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 642] <... futex resumed>) = 0 [pid 641] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(4, [pid 645] memfd_create("syzkaller", 0 [pid 644] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 643] <... openat resumed>) = 5 [pid 645] <... memfd_create resumed>) = 3 [pid 642] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 641] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 645] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 644] <... open resumed>) = 6 [pid 643] ioctl(5, LOOP_SET_FD, 3 [pid 641] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] close(4 [pid 645] <... mmap resumed>) = 0x7f0c41dee000 [ 25.994015][ T628] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 26.008885][ T633] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 26.009427][ T628] EXT4-fs (loop5): get root inode failed [ 26.023357][ T633] EXT4-fs (loop3): get root inode failed [ 26.027838][ T628] EXT4-fs (loop5): mount failed [ 26.034819][ T633] EXT4-fs (loop3): mount failed [pid 644] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] <... mmap resumed>) = 0x7f0c41dcd000 [pid 298] <... close resumed>) = 0 [pid 645] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 644] <... futex resumed>) = 1 [pid 643] <... ioctl resumed>) = 0 [pid 642] <... futex resumed>) = 0 [pid 641] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 298] rmdir("./10/file1" [pid 644] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 643] close(3 [pid 642] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] <... mprotect resumed>) = 0 [pid 644] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 643] <... close resumed>) = 0 [pid 642] <... futex resumed>) = 0 [pid 641] rt_sigprocmask(SIG_BLOCK, ~[], [pid 298] <... rmdir resumed>) = 0 [pid 644] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 643] mkdir("./bus", 0777 [pid 642] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 641] <... rt_sigprocmask resumed>[], 8) = 0 [pid 298] getdents64(3, [pid 645] <... write resumed>) = 262144 [pid 643] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 641] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3 [pid 641] <... clone3 resumed> => {parent_tid=[646]}, 88) = 646 [pid 298] <... close resumed>) = 0 [pid 641] rt_sigprocmask(SIG_SETMASK, [], [pid 298] rmdir("./10" [pid 644] <... write resumed>) = 8 [pid 641] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 645] munmap(0x7f0c41dee000, 138412032 [pid 643] mount("/dev/loop1", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 646 attached [pid 644] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... rmdir resumed>) = 0 [pid 646] set_robust_list(0x7f0c41ded9a0, 24 [pid 645] <... munmap resumed>) = 0 [pid 644] <... futex resumed>) = 1 [pid 642] <... futex resumed>) = 0 [pid 641] <... futex resumed>) = 0 [pid 298] mkdir("./11", 0777 [pid 645] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 644] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 642] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 645] <... openat resumed>) = 4 [pid 642] <... futex resumed>) = 0 [pid 645] ioctl(4, LOOP_SET_FD, 3 [pid 642] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... mkdir resumed>) = 0 [pid 644] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 644] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 298] <... openat resumed>) = 3 [pid 645] <... ioctl resumed>) = 0 [pid 644] <... write resumed>) = 1045 [pid 298] ioctl(3, LOOP_CLR_FD [pid 644] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 644] <... futex resumed>) = 1 [pid 298] close(3 [pid 644] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 642] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 645] close(3) = 0 [pid 645] mkdir("./file1", 0777 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 648 [pid 646] <... set_robust_list resumed>) = 0 [pid 646] rt_sigprocmask(SIG_SETMASK, [], [pid 645] <... mkdir resumed>) = 0 [pid 645] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 646] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 646] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 646] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] <... futex resumed>) = 0 [pid 646] <... futex resumed>) = 1 [pid 641] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 641] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 646] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL./strace-static-x86_64: Process 648 attached [pid 630] <... ioctl resumed>) = 0 [pid 648] set_robust_list(0x555556d8d6a0, 24 [pid 646] <... mount resumed>) = 0 [pid 630] close(5 [pid 646] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] <... futex resumed>) = 0 [pid 641] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 641] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 646] <... futex resumed>) = 1 [pid 646] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 5 [pid 646] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 641] <... futex resumed>) = 0 [pid 641] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 641] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 646] <... futex resumed>) = 1 [pid 646] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 630] <... close resumed>) = 0 [pid 630] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 630] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 648] <... set_robust_list resumed>) = 0 [pid 627] exit_group(0 [pid 631] <... futex resumed>) = ? [pid 630] <... futex resumed>) = ? [pid 627] <... exit_group resumed>) = ? [pid 631] +++ exited with 0 +++ [pid 630] +++ exited with 0 +++ [pid 627] +++ exited with 0 +++ [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=627, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 625] +++ exited with 0 +++ [pid 294] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 294] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 294] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 648] chdir("./11" [pid 294] unlink("./11/binderfs" [pid 648] <... chdir resumed>) = 0 [pid 294] <... unlink resumed>) = 0 [pid 648] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 294] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 648] <... prctl resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 648] setpgid(0, 0 [pid 294] newfstatat(AT_FDCWD, "./11/file1", [pid 648] <... setpgid resumed>) = 0 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 648] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 294] unlink("./11/file1" [pid 648] <... openat resumed>) = 3 [pid 294] <... unlink resumed>) = 0 [pid 648] write(3, "1000", 4 [pid 294] getdents64(3, [pid 648] <... write resumed>) = 4 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 648] close(3 [pid 294] close(3 [pid 648] <... close resumed>) = 0 [pid 294] <... close resumed>) = 0 [pid 648] symlink("/dev/binderfs", "./binderfs" [ 26.067546][ T643] loop1: detected capacity change from 0 to 512 [ 26.078869][ T645] loop2: detected capacity change from 0 to 512 [ 26.091102][ T643] EXT4-fs error (device loop1): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 26.109160][ T643] EXT4-fs (loop1): get root inode failed [pid 294] rmdir("./11" [pid 648] <... symlink resumed>) = 0 [pid 646] <... write resumed>) = 8 [pid 632] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=625, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 294] <... rmdir resumed>) = 0 [pid 648] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 646] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 643] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=632, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 294] mkdir("./12", 0777 [pid 648] <... futex resumed>) = 0 [pid 646] <... futex resumed>) = 1 [pid 643] ioctl(5, LOOP_CLR_FD [pid 641] <... futex resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 648] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 646] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 643] <... ioctl resumed>) = 0 [pid 641] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 648] <... rt_sigaction resumed>NULL, 8) = 0 [pid 646] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 643] close(5 [pid 641] <... futex resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 643] <... close resumed>) = 0 [pid 299] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 643] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... openat resumed>) = 3 [pid 643] <... futex resumed>) = 0 [pid 299] newfstatat(3, "", [pid 643] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 642] exit_group(0 [pid 299] getdents64(3, [pid 643] <... futex resumed>) = ? [pid 642] <... exit_group resumed>) = ? [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 643] +++ exited with 0 +++ [pid 299] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 648] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 646] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 641] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... openat resumed>) = 3 [pid 644] <... futex resumed>) = ? [pid 299] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 648] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 648] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 648] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 648] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 648] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[652]}, 88) = 652 [pid 648] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 648] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 648] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 648] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 648] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 648] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 648] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[653]}, 88) = 653 [pid 648] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 648] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 648] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] ioctl(3, LOOP_CLR_FD./strace-static-x86_64: Process 653 attached ./strace-static-x86_64: Process 652 attached [pid 646] <... write resumed>) = 1045 [pid 645] <... mount resumed>) = 0 [pid 299] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 653] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 652] set_robust_list(0x7f0c4a20e9a0, 24 [pid 646] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 645] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... openat resumed>) = 3 [pid 294] close(3 [pid 653] <... set_robust_list resumed>) = 0 [pid 652] <... set_robust_list resumed>) = 0 [pid 646] <... futex resumed>) = 1 [pid 645] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 641] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./11/bus", [pid 297] newfstatat(3, "", [pid 294] <... close resumed>) = 0 [pid 653] rt_sigprocmask(SIG_SETMASK, [], [pid 652] rt_sigprocmask(SIG_SETMASK, [], [pid 646] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 645] ioctl(4, LOOP_CLR_FD [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 653] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 652] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 645] <... ioctl resumed>) = 0 [pid 299] unlink("./11/bus" [pid 297] getdents64(3, ./strace-static-x86_64: Process 654 attached [pid 653] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 652] memfd_create("syzkaller", 0 [pid 645] close(4 [pid 299] <... unlink resumed>) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 654 [pid 654] set_robust_list(0x555556d8d6a0, 24 [pid 653] <... open resumed>) = 3 [pid 652] <... memfd_create resumed>) = 4 [pid 645] <... close resumed>) = 0 [pid 299] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 654] <... set_robust_list resumed>) = 0 [pid 653] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 645] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = 0 [pid 653] <... futex resumed>) = 1 [pid 652] <... mmap resumed>) = 0x7f0c41dcd000 [pid 648] <... futex resumed>) = 0 [pid 645] <... futex resumed>) = 0 [pid 299] newfstatat(AT_FDCWD, "./11/binderfs", [pid 297] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 654] chdir("./12" [pid 653] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 652] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 648] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 645] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 654] <... chdir resumed>) = 0 [pid 653] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 652] <... write resumed>) = 262144 [pid 648] <... futex resumed>) = 0 [pid 299] unlink("./11/binderfs" [pid 297] newfstatat(AT_FDCWD, "./11/bus", [pid 654] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 653] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL [pid 652] munmap(0x7f0c41dcd000, 138412032 [pid 648] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 641] exit_group(0 [pid 299] <... unlink resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 654] <... prctl resumed>) = 0 [pid 653] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 652] <... munmap resumed>) = 0 [pid 646] <... futex resumed>) = ? [pid 645] <... futex resumed>) = ? [pid 641] <... exit_group resumed>) = ? [pid 299] getdents64(3, [pid 297] unlink("./11/bus" [pid 654] setpgid(0, 0 [pid 653] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 646] +++ exited with 0 +++ [pid 645] +++ exited with 0 +++ [pid 644] +++ exited with 0 +++ [pid 642] +++ exited with 0 +++ [pid 641] +++ exited with 0 +++ [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] <... unlink resumed>) = 0 [pid 654] <... setpgid resumed>) = 0 [pid 653] <... futex resumed>) = 1 [pid 652] <... openat resumed>) = 5 [pid 648] <... futex resumed>) = 0 [pid 299] close(3 [pid 297] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 654] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [ 26.114668][ T643] EXT4-fs (loop1): mount failed [ 26.123251][ T645] EXT4-fs (loop2): 1 orphan inode deleted [ 26.134950][ T645] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 26.146545][ T645] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/11/file1 supports timestamps until 2038 (0x7fffffff) [pid 653] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 652] ioctl(5, LOOP_SET_FD, 4 [pid 648] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=642, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 654] <... openat resumed>) = 3 [pid 653] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 648] <... futex resumed>) = 0 [pid 299] rmdir("./11" [pid 297] newfstatat(AT_FDCWD, "./11/binderfs", [pid 295] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 654] write(3, "1000", 4 [pid 653] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 652] <... ioctl resumed>) = 0 [pid 648] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... rmdir resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=641, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 654] <... write resumed>) = 4 [pid 653] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 652] close(4 [pid 299] mkdir("./12", 0777 [pid 297] unlink("./11/binderfs" [pid 296] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 654] close(3 [pid 653] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 652] <... close resumed>) = 0 [pid 299] <... mkdir resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... openat resumed>) = 3 [pid 654] <... close resumed>) = 0 [pid 653] <... futex resumed>) = 1 [pid 652] mkdir("./file1", 0777 [pid 648] <... futex resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] getdents64(3, [pid 296] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] newfstatat(3, "", [pid 654] symlink("/dev/binderfs", "./binderfs" [pid 653] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 652] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 648] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... openat resumed>) = 3 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 654] <... symlink resumed>) = 0 [pid 653] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 652] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 648] <... futex resumed>) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] close(3 [pid 296] newfstatat(3, "", [pid 295] getdents64(3, [pid 654] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 653] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 648] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... close resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 654] <... futex resumed>) = 0 [pid 653] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 299] close(3 [pid 297] rmdir("./11" [pid 296] getdents64(3, [pid 295] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 654] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 653] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] <... close resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 295] <... umount2 resumed>) = 0 [pid 654] <... rt_sigaction resumed>NULL, 8) = 0 [pid 653] <... futex resumed>) = 1 [pid 648] <... futex resumed>) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] mkdir("./12", 0777 [pid 296] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 654] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 653] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 648] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... mkdir resumed>) = 0 [pid 296] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 654] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 653] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 648] <... futex resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 655 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] umount2("./11/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] newfstatat(AT_FDCWD, "./11/bus", [pid 654] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 653] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 648] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 297] <... openat resumed>) = 3 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 654] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 653] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 297] ioctl(3, LOOP_CLR_FD [pid 296] newfstatat(AT_FDCWD, "./11/bus", [pid 295] unlink("./11/bus" [pid 654] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 653] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... unlink resumed>) = 0 [pid 654] <... mprotect resumed>) = 0 [pid 653] <... futex resumed>) = 1 [pid 648] <... futex resumed>) = 0 [pid 297] close(3 [pid 296] unlink("./11/bus" [pid 295] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 654] rt_sigprocmask(SIG_BLOCK, ~[], [pid 653] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 297] <... close resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 654] <... rt_sigprocmask resumed>[], 8) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 296] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] newfstatat(AT_FDCWD, "./11/binderfs", [pid 654] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 656 [pid 296] newfstatat(AT_FDCWD, "./11/binderfs", [pid 295] unlink("./11/binderfs" [pid 654] <... clone3 resumed> => {parent_tid=[657]}, 88) = 657 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... unlink resumed>) = 0 [pid 654] rt_sigprocmask(SIG_SETMASK, [], [pid 296] unlink("./11/binderfs" [pid 295] getdents64(3, [pid 654] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... unlink resumed>) = 0 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 654] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] close(3 [pid 654] <... futex resumed>) = 0 [pid 295] <... close resumed>) = 0 ./strace-static-x86_64: Process 655 attached [pid 654] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] rmdir("./11" [pid 655] set_robust_list(0x555556d8d6a0, 24 [pid 654] <... futex resumed>) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 655] <... set_robust_list resumed>) = 0 [pid 654] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] mkdir("./12", 0777 [pid 655] chdir("./12" [pid 654] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 295] <... mkdir resumed>) = 0 [pid 655] <... chdir resumed>) = 0 [pid 654] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 655] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 654] <... mprotect resumed>) = 0 [pid 295] <... openat resumed>) = 3 [pid 655] <... prctl resumed>) = 0 [pid 654] rt_sigprocmask(SIG_BLOCK, ~[], [pid 295] ioctl(3, LOOP_CLR_FD [pid 655] setpgid(0, 0 [pid 654] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 655] <... setpgid resumed>) = 0 [pid 654] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 295] close(3 [pid 655] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 295] <... close resumed>) = 0 ./strace-static-x86_64: Process 657 attached [pid 655] <... openat resumed>) = 3 [pid 654] <... clone3 resumed> => {parent_tid=[660]}, 88) = 660 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD./strace-static-x86_64: Process 661 attached ./strace-static-x86_64: Process 660 attached ./strace-static-x86_64: Process 656 attached [pid 657] set_robust_list(0x7f0c4a20e9a0, 24 [pid 655] write(3, "1000", 4 [pid 654] rt_sigprocmask(SIG_SETMASK, [], [pid 657] <... set_robust_list resumed>) = 0 [pid 656] set_robust_list(0x555556d8d6a0, 24 [pid 655] <... write resumed>) = 4 [pid 654] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 661 [pid 657] rt_sigprocmask(SIG_SETMASK, [], [pid 656] <... set_robust_list resumed>) = 0 [pid 655] close(3 [pid 654] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 657] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 656] chdir("./12" [pid 655] <... close resumed>) = 0 [pid 654] <... futex resumed>) = 0 [pid 657] memfd_create("syzkaller", 0 [pid 656] <... chdir resumed>) = 0 [pid 655] symlink("/dev/binderfs", "./binderfs" [pid 654] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 661] set_robust_list(0x555556d8d6a0, 24 [pid 660] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 657] <... memfd_create resumed>) = 3 [pid 656] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 655] <... symlink resumed>) = 0 [pid 661] <... set_robust_list resumed>) = 0 [pid 660] <... set_robust_list resumed>) = 0 [pid 661] chdir("./12" [pid 660] rt_sigprocmask(SIG_SETMASK, [], [pid 661] <... chdir resumed>) = 0 [pid 660] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 661] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 660] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 661] <... prctl resumed>) = 0 [pid 660] <... open resumed>) = 4 [pid 661] setpgid(0, 0 [pid 660] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 661] <... setpgid resumed>) = 0 [ 26.173316][ T652] loop4: detected capacity change from 0 to 512 [ 26.206456][ T652] EXT4-fs (loop4): 1 orphan inode deleted [pid 660] <... futex resumed>) = 0 [pid 661] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 660] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 661] <... openat resumed>) = 3 [pid 657] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 655] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 654] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 661] write(3, "1000", 4 [pid 656] <... prctl resumed>) = 0 [pid 661] <... write resumed>) = 4 [pid 661] close(3) = 0 [pid 661] symlink("/dev/binderfs", "./binderfs") = 0 [pid 661] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = 0 [pid 661] <... futex resumed>) = 0 [pid 296] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 661] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 661] <... rt_sigaction resumed>NULL, 8) = 0 [pid 296] newfstatat(AT_FDCWD, "./11/file1", [pid 661] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 661] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 661] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 661] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 296] openat(AT_FDCWD, "./11/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 661] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 657] <... mmap resumed>) = 0x7f0c41dcd000 [pid 296] <... openat resumed>) = 4 [pid 655] <... futex resumed>) = 0 [pid 661] <... mprotect resumed>) = 0 [pid 656] setpgid(0, 0 [pid 654] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] newfstatat(4, "", [pid 661] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 661] <... rt_sigprocmask resumed>[], 8) = 0 [pid 660] <... futex resumed>) = 0 [pid 657] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 656] <... setpgid resumed>) = 0 [pid 655] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 654] <... futex resumed>) = 1 [pid 296] getdents64(4, [pid 661] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 660] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 657] <... write resumed>) = 262144 [pid 656] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 655] <... rt_sigaction resumed>NULL, 8) = 0 [pid 654] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 657] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 657] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 5 [pid 657] ioctl(5, LOOP_SET_FD, 3 [pid 296] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 ./strace-static-x86_64: Process 662 attached [pid 660] <... mount resumed>) = 0 [pid 656] <... openat resumed>) = 3 [pid 655] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 296] getdents64(4, [pid 662] set_robust_list(0x7f0c4a20e9a0, 24 [pid 661] <... clone3 resumed> => {parent_tid=[662]}, 88) = 662 [pid 660] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] write(3, "1000", 4 [pid 655] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 662] <... set_robust_list resumed>) = 0 [pid 661] rt_sigprocmask(SIG_SETMASK, [], [pid 660] <... futex resumed>) = 1 [pid 656] <... write resumed>) = 4 [pid 655] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 654] <... futex resumed>) = 0 [pid 296] close(4 [pid 662] rt_sigprocmask(SIG_SETMASK, [], [pid 661] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 660] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 656] close(3 [pid 655] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 654] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... close resumed>) = 0 [pid 657] <... ioctl resumed>) = 0 [pid 657] close(3 [pid 661] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 660] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 656] <... close resumed>) = 0 [pid 655] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 654] <... futex resumed>) = 0 [pid 661] <... futex resumed>) = 0 [pid 654] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] rmdir("./11/file1" [pid 661] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 660] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 656] symlink("/dev/binderfs", "./binderfs" [pid 655] <... mprotect resumed>) = 0 [pid 657] <... close resumed>) = 0 [pid 657] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 657] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 296] <... rmdir resumed>) = 0 [pid 661] <... futex resumed>) = 0 [pid 660] <... open resumed>) = 3 [pid 656] <... symlink resumed>) = 0 [pid 661] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 660] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 655] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] getdents64(3, [pid 656] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 661] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 660] <... futex resumed>) = 1 [pid 655] <... rt_sigprocmask resumed>[], 8) = 0 [pid 654] <... futex resumed>) = 0 [pid 656] <... futex resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 661] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 660] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 655] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 654] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 296] close(3 [pid 661] <... mprotect resumed>) = 0 [pid 660] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 654] <... futex resumed>) = 0 [pid 656] <... rt_sigaction resumed>NULL, 8) = 0 [pid 296] <... close resumed>) = 0 [pid 661] rt_sigprocmask(SIG_BLOCK, ~[], [pid 654] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 660] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 655] <... clone3 resumed> => {parent_tid=[663]}, 88) = 663 [pid 656] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 296] rmdir("./11" [pid 661] <... rt_sigprocmask resumed>[], 8) = 0 [pid 662] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 662] memfd_create("syzkaller", 0 [pid 661] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 660] <... write resumed>) = 8 [pid 656] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 655] rt_sigprocmask(SIG_SETMASK, [], [pid 662] <... memfd_create resumed>) = 3 [pid 662] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 296] <... rmdir resumed>) = 0 [pid 662] <... mmap resumed>) = 0x7f0c41dcd000 [pid 662] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 660] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 655] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] mkdir("./12", 0777 [pid 662] <... write resumed>) = 262144 [pid 662] munmap(0x7f0c41dcd000, 138412032) = 0 [pid 662] openat(AT_FDCWD, "/dev/loop1", O_RDWR) = 4 [pid 662] ioctl(4, LOOP_SET_FD, 3 [pid 661] <... clone3 resumed> => {parent_tid=[664]}, 88) = 664 [pid 660] <... futex resumed>) = 1 [pid 656] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 655] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 654] <... futex resumed>) = 0 [pid 296] <... mkdir resumed>) = 0 [pid 661] rt_sigprocmask(SIG_SETMASK, [], [pid 660] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 656] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 655] <... futex resumed>) = 0 [pid 654] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 661] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 660] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 656] <... mprotect resumed>) = 0 [pid 655] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 654] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 661] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 660] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 662] <... ioctl resumed>) = 0 [pid 656] rt_sigprocmask(SIG_BLOCK, ~[], [pid 655] <... futex resumed>) = 0 [pid 654] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 662] close(3) = 0 [pid 655] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 661] <... futex resumed>) = 0 [pid 655] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 662] mkdir("./file1", 0777 [pid 655] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 661] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 660] <... write resumed>) = 1045 [pid 656] <... rt_sigprocmask resumed>[], 8) = 0 [pid 296] <... openat resumed>) = 3 [pid 655] <... mprotect resumed>) = 0 [pid 660] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 296] ioctl(3, LOOP_CLR_FD [pid 660] <... futex resumed>) = 1 [pid 655] rt_sigprocmask(SIG_BLOCK, ~[], [pid 654] <... futex resumed>) = 0 [pid 655] <... rt_sigprocmask resumed>[], 8) = 0 [pid 660] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 656] <... clone3 resumed> => {parent_tid=[665]}, 88) = 665 [pid 655] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 656] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 655] <... clone3 resumed> => {parent_tid=[666]}, 88) = 666 [pid 296] close(3 [pid 656] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 655] rt_sigprocmask(SIG_SETMASK, [], [pid 296] <... close resumed>) = 0 [pid 662] <... mkdir resumed>) = 0 [pid 662] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 665 attached [pid 665] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 665] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 665] memfd_create("syzkaller", 0) = 3 [pid 665] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0c41dee000 [pid 665] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 665] munmap(0x7f0c41dee000, 138412032) = 0 [pid 665] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [ 26.213981][ T652] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 26.225687][ T652] ext4 filesystem being mounted at /root/syzkaller.qPQybd/11/file1 supports timestamps until 2038 (0x7fffffff) [ 26.240970][ T657] loop0: detected capacity change from 0 to 512 [ 26.253604][ T662] loop1: detected capacity change from 0 to 512 [ 26.266230][ T665] loop3: detected capacity change from 0 to 512 [pid 665] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 666 attached ./strace-static-x86_64: Process 664 attached ./strace-static-x86_64: Process 663 attached [pid 656] <... futex resumed>) = 0 [pid 655] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 656] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 655] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] <... futex resumed>) = 0 [pid 655] <... futex resumed>) = 0 [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 667 [pid 656] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 655] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 656] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 656] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 656] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 656] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[668]}, 88) = 668 [pid 656] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 656] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 656] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 664] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 665] <... ioctl resumed>) = 0 [pid 652] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 652] ioctl(5, LOOP_CLR_FD [pid 664] <... set_robust_list resumed>) = 0 [pid 664] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 664] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 663] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 663] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 663] memfd_create("syzkaller", 0) = 3 [pid 664] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 661] <... futex resumed>) = 0 [pid 661] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 661] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 664] <... futex resumed>) = 1 [pid 664] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL) = 0 [pid 663] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 666] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 664] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 663] <... mmap resumed>) = 0x7f0c41dcd000 [pid 666] <... set_robust_list resumed>) = 0 [pid 664] <... futex resumed>) = 1 [pid 661] <... futex resumed>) = 0 [pid 666] rt_sigprocmask(SIG_SETMASK, [], [pid 664] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 661] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 666] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 664] <... open resumed>) = 5 [pid 663] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 661] <... futex resumed>) = 0 [pid 666] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 664] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 661] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 666] <... open resumed>) = 4 [pid 665] close(3 [pid 664] <... futex resumed>) = 0 [pid 661] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 661] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 661] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 668 attached ./strace-static-x86_64: Process 667 attached [pid 666] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 664] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 663] <... write resumed>) = 262144 [pid 668] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 667] set_robust_list(0x555556d8d6a0, 24 [pid 666] <... futex resumed>) = 1 [pid 664] <... write resumed>) = 8 [pid 655] <... futex resumed>) = 0 [pid 668] <... set_robust_list resumed>) = 0 [pid 667] <... set_robust_list resumed>) = 0 [pid 666] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 665] <... close resumed>) = 0 [pid 664] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 663] munmap(0x7f0c41dcd000, 138412032 [pid 655] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] rt_sigprocmask(SIG_SETMASK, [], [pid 667] chdir("./12" [pid 666] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 664] <... futex resumed>) = 1 [pid 663] <... munmap resumed>) = 0 [pid 661] <... futex resumed>) = 0 [pid 655] <... futex resumed>) = 0 [pid 668] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 667] <... chdir resumed>) = 0 [pid 666] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 664] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 663] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 661] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 655] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 668] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 667] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 666] <... mount resumed>) = 0 [pid 664] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 663] <... openat resumed>) = 5 [pid 661] <... futex resumed>) = 0 [pid 668] <... open resumed>) = 3 [pid 667] <... prctl resumed>) = 0 [pid 666] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 665] mkdir("./bus", 0777 [pid 664] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 663] ioctl(5, LOOP_SET_FD, 3 [pid 661] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 668] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 667] setpgid(0, 0 [pid 666] <... futex resumed>) = 1 [pid 655] <... futex resumed>) = 0 [pid 652] <... ioctl resumed>) = 0 [pid 668] <... futex resumed>) = 1 [pid 667] <... setpgid resumed>) = 0 [pid 666] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 656] <... futex resumed>) = 0 [pid 655] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 667] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 666] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 656] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 655] <... futex resumed>) = 0 [pid 668] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 667] <... openat resumed>) = 3 [pid 666] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 656] <... futex resumed>) = 0 [pid 655] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 668] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 667] write(3, "1000", 4 [pid 656] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 668] <... mount resumed>) = 0 [pid 667] <... write resumed>) = 4 [pid 668] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 667] close(3 [pid 668] <... futex resumed>) = 1 [pid 667] <... close resumed>) = 0 [pid 656] <... futex resumed>) = 0 [pid 668] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 667] symlink("/dev/binderfs", "./binderfs" [pid 656] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 667] <... symlink resumed>) = 0 [pid 656] <... futex resumed>) = 0 [pid 668] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 667] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 668] <... open resumed>) = 5 [pid 667] <... futex resumed>) = 0 [pid 668] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 667] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 668] <... futex resumed>) = 1 [pid 667] <... rt_sigaction resumed>NULL, 8) = 0 [pid 664] <... write resumed>) = 1045 [pid 656] <... futex resumed>) = 0 [pid 652] close(5 [ 26.273639][ T657] EXT4-fs error (device loop0): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 26.287757][ T657] EXT4-fs (loop0): get root inode failed [ 26.293467][ T657] EXT4-fs (loop0): mount failed [ 26.301332][ T662] EXT4-fs (loop1): 1 orphan inode deleted [ 26.304364][ T663] loop5: detected capacity change from 0 to 512 [ 26.306890][ T662] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 668] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 667] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 665] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 664] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 657] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 656] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 667] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 656] <... futex resumed>) = 0 [pid 668] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 667] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 656] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 667] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 667] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 667] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 667] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[673]}, 88) = 673 [pid 667] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 667] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 667] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 667] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 667] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 667] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 667] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[674]}, 88) = 674 [pid 667] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 667] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 667] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 666] <... open resumed>) = 6 [pid 663] <... ioctl resumed>) = 0 [pid 666] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 663] close(3 [pid 666] <... futex resumed>) = 1 [pid 665] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 664] <... futex resumed>) = 1 [pid 661] <... futex resumed>) = 0 [pid 657] ioctl(5, LOOP_CLR_FD [pid 655] <... futex resumed>) = 0 [pid 652] <... close resumed>) = 0 [pid 664] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 657] <... ioctl resumed>) = 0 [pid 652] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 657] close(5 [pid 652] <... futex resumed>) = 0 [pid 657] <... close resumed>) = 0 [pid 652] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 657] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 657] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL./strace-static-x86_64: Process 673 attached ./strace-static-x86_64: Process 674 attached [pid 674] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 673] set_robust_list(0x7f0c4a20e9a0, 24 [pid 674] <... set_robust_list resumed>) = 0 [pid 673] <... set_robust_list resumed>) = 0 [pid 674] rt_sigprocmask(SIG_SETMASK, [], [pid 673] rt_sigprocmask(SIG_SETMASK, [], [pid 674] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 673] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 674] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 673] memfd_create("syzkaller", 0) = 3 [pid 668] <... write resumed>) = 8 [pid 666] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 663] <... close resumed>) = 0 [pid 655] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 656] <... futex resumed>) = 0 [pid 668] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 656] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 668] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 656] <... futex resumed>) = 0 [pid 668] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 656] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 668] <... write resumed>) = 1045 [pid 663] mkdir("./bus", 0777 [pid 655] <... futex resumed>) = 0 [pid 666] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 668] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 656] <... futex resumed>) = 0 [pid 668] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 674] <... open resumed>) = 4 [pid 666] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 663] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 655] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 654] exit_group(0 [pid 648] exit_group(0 [pid 663] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 660] <... futex resumed>) = ? [pid 657] <... futex resumed>) = ? [pid 654] <... exit_group resumed>) = ? [pid 653] <... futex resumed>) = ? [pid 652] <... futex resumed>) = ? [pid 648] <... exit_group resumed>) = ? [pid 673] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 660] +++ exited with 0 +++ [pid 657] +++ exited with 0 +++ [pid 674] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 653] +++ exited with 0 +++ [pid 652] +++ exited with 0 +++ [pid 673] <... mmap resumed>) = 0x7f0c41dcd000 [pid 674] <... futex resumed>) = 1 [pid 667] <... futex resumed>) = 0 [pid 648] +++ exited with 0 +++ [pid 666] <... write resumed>) = 8 [pid 674] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 667] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 674] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 667] <... futex resumed>) = 0 [pid 674] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 667] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 674] <... futex resumed>) = 0 [pid 667] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 674] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 667] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 674] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 667] <... futex resumed>) = 0 [pid 674] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 667] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 666] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=648, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 674] <... futex resumed>) = 0 [pid 673] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 667] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 666] <... futex resumed>) = 1 [pid 655] <... futex resumed>) = 0 [pid 674] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 673] <... write resumed>) = 262144 [pid 667] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 674] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 667] <... futex resumed>) = 0 [pid 674] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 667] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 674] <... futex resumed>) = 0 [pid 667] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 674] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 667] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 674] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 667] <... futex resumed>) = 0 [pid 674] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 667] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 674] <... futex resumed>) = 0 [pid 673] munmap(0x7f0c41dcd000, 138412032 [pid 667] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 674] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 673] <... munmap resumed>) = 0 [pid 673] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 5 [pid 673] ioctl(5, LOOP_SET_FD, 3 [pid 666] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 662] <... mount resumed>) = 0 [pid 655] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 662] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 655] <... futex resumed>) = 0 [pid 298] umount2("./11", MNT_DETACH|UMOUNT_NOFOLLOW [pid 662] <... openat resumed>) = -1 ENOTDIR (Not a directory) [pid 655] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 662] ioctl(4, LOOP_CLR_FD [pid 298] openat(AT_FDCWD, "./11", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 662] <... ioctl resumed>) = 0 [pid 298] <... openat resumed>) = 3 [pid 662] close(4 [pid 298] newfstatat(3, "", [pid 673] <... ioctl resumed>) = 0 [pid 666] <... write resumed>) = 1045 [pid 662] <... close resumed>) = 0 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 666] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 662] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(3, [pid 666] <... futex resumed>) = 1 [pid 662] <... futex resumed>) = 0 [pid 655] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 666] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 662] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] umount2("./11/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./11/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./11/binderfs") = 0 [pid 298] umount2("./11/file1", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./11/file1", {st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./11/file1") = 0 [pid 298] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 298] close(3) = 0 [pid 298] rmdir("./11") = 0 [pid 298] mkdir("./12", 0777) = 0 [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR) = 3 [pid 298] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 298] close(3) = 0 [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 677 [pid 661] exit_group(0 [pid 664] <... futex resumed>) = ? [pid 662] <... futex resumed>) = ? [pid 661] <... exit_group resumed>) = ? ./strace-static-x86_64: Process 677 attached [pid 673] close(3 [pid 664] +++ exited with 0 +++ [pid 662] +++ exited with 0 +++ [pid 661] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=661, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 295] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 295] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 295] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 295] getdents64(3, 0x555556d8e730 /* 5 entries */, 32768) = 136 [ 26.324637][ T662] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/12/file1 supports timestamps until 2038 (0x7fffffff) [ 26.347959][ T673] loop2: detected capacity change from 0 to 512 [ 26.354951][ T665] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 26.368969][ T665] EXT4-fs (loop3): get root inode failed [pid 295] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 677] set_robust_list(0x555556d8d6a0, 24 [pid 673] <... close resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 677] <... set_robust_list resumed>) = 0 [pid 677] chdir("./12") = 0 [pid 677] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 677] setpgid(0, 0) = 0 [pid 677] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 673] mkdir("./file1", 0777 [pid 295] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 677] write(3, "1000", 4) = 4 [pid 677] close(3) = 0 [pid 677] symlink("/dev/binderfs", "./binderfs") = 0 [pid 677] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 677] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 677] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 677] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 677] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 677] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 677] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0}./strace-static-x86_64: Process 680 attached [pid 673] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 677] <... clone3 resumed> => {parent_tid=[680]}, 88) = 680 [pid 680] set_robust_list(0x7f0c4a20e9a0, 24 [pid 673] mount("/dev/loop2", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 654] +++ exited with 0 +++ [pid 295] newfstatat(AT_FDCWD, "./12/bus", [pid 680] <... set_robust_list resumed>) = 0 [pid 677] rt_sigprocmask(SIG_SETMASK, [], [pid 665] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 680] rt_sigprocmask(SIG_SETMASK, [], [pid 677] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 665] ioctl(4, LOOP_CLR_FD [pid 295] unlink("./12/bus" [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=654, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 680] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 677] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 665] <... ioctl resumed>) = 0 [pid 295] <... unlink resumed>) = 0 [pid 294] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 680] memfd_create("syzkaller", 0 [pid 677] <... futex resumed>) = 0 [pid 665] close(4 [pid 295] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 680] <... memfd_create resumed>) = 3 [pid 677] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 665] <... close resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 680] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 677] <... futex resumed>) = 0 [pid 665] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 656] exit_group(0 [pid 295] newfstatat(AT_FDCWD, "./12/binderfs", [pid 294] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 680] <... mmap resumed>) = 0x7f0c41dee000 [pid 677] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 668] <... futex resumed>) = ? [pid 665] <... futex resumed>) = ? [pid 656] <... exit_group resumed>) = ? [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... openat resumed>) = 3 [pid 680] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 677] <... mmap resumed>) = 0x7f0c41dcd000 [pid 668] +++ exited with 0 +++ [pid 665] +++ exited with 0 +++ [pid 295] unlink("./12/binderfs" [pid 680] <... write resumed>) = 262144 [pid 677] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 295] <... unlink resumed>) = 0 [pid 294] newfstatat(3, "", [pid 680] munmap(0x7f0c41dee000, 138412032 [pid 677] <... mprotect resumed>) = 0 [pid 295] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 680] <... munmap resumed>) = 0 [pid 677] rt_sigprocmask(SIG_BLOCK, ~[], [pid 663] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 294] getdents64(3, [pid 680] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 677] <... rt_sigprocmask resumed>[], 8) = 0 [pid 663] ioctl(5, LOOP_CLR_FD [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 680] <... openat resumed>) = 4 [pid 677] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 294] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW) = 0 [pid 680] ioctl(4, LOOP_SET_FD, 3 [pid 677] <... clone3 resumed> => {parent_tid=[683]}, 88) = 683 [pid 294] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 677] rt_sigprocmask(SIG_SETMASK, [], [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 677] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 294] newfstatat(AT_FDCWD, "./12/bus", [pid 677] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 677] <... futex resumed>) = 0 [pid 294] unlink("./12/bus" [pid 677] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 294] <... unlink resumed>) = 0 [pid 294] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument) [pid 294] newfstatat(AT_FDCWD, "./12/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] unlink("./12/binderfs") = 0 [pid 294] getdents64(3, 0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] close(3) = 0 [pid 294] rmdir("./12") = 0 [pid 294] mkdir("./13", 0777) = 0 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3 [pid 294] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 294] close(3) = 0 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 684 [pid 663] <... ioctl resumed>) = 0 [pid 663] close(5) = 0 [ 26.374530][ T663] EXT4-fs error (device loop5): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 26.374578][ T665] EXT4-fs (loop3): mount failed [ 26.392291][ T663] EXT4-fs (loop5): get root inode failed [ 26.397861][ T663] EXT4-fs (loop5): mount failed [ 26.418725][ T680] loop4: detected capacity change from 0 to 512 [pid 663] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 663] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 655] exit_group(0 [pid 666] <... futex resumed>) = ? [pid 663] <... futex resumed>) = ? [pid 655] <... exit_group resumed>) = ? [pid 666] +++ exited with 0 +++ [pid 663] +++ exited with 0 +++ ./strace-static-x86_64: Process 683 attached [pid 683] set_robust_list(0x7f0c41ded9a0, 24) = 0 [pid 683] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 683] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 5 [pid 683] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 677] <... futex resumed>) = 0 [pid 677] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 677] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 683] <... futex resumed>) = 1 [pid 683] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 683] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 677] <... futex resumed>) = 0 [pid 677] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 677] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 683] <... futex resumed>) = 1 [pid 683] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 680] <... ioctl resumed>) = 0 [pid 680] close(3) = 0 [pid 680] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 680] mount("/dev/loop4", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 684 attached [pid 684] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 684] chdir("./13" [pid 656] +++ exited with 0 +++ [pid 655] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=655, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=656, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 684] <... chdir resumed>) = 0 [pid 299] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 683] <... open resumed>) = 6 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 683] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 297] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 683] <... futex resumed>) = 1 [pid 677] <... futex resumed>) = 0 [pid 299] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 683] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 677] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] newfstatat(3, "", [pid 297] newfstatat(3, "", [pid 677] <... futex resumed>) = 0 [pid 299] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 684] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 677] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 299] getdents64(3, [pid 297] getdents64(3, [pid 684] <... prctl resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 299] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 684] setpgid(0, 0 [pid 299] <... umount2 resumed>) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 295] <... umount2 resumed>) = 0 [pid 684] <... setpgid resumed>) = 0 [pid 299] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 684] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 684] <... openat resumed>) = 3 [pid 299] newfstatat(AT_FDCWD, "./12/bus", [pid 297] newfstatat(AT_FDCWD, "./12/bus", [pid 295] newfstatat(AT_FDCWD, "./12/file1", [pid 684] write(3, "1000", 4 [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 684] <... write resumed>) = 4 [pid 683] <... write resumed>) = 8 [pid 299] unlink("./12/bus" [pid 297] unlink("./12/bus" [pid 295] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 684] close(3 [pid 299] <... unlink resumed>) = 0 [pid 683] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 297] <... unlink resumed>) = 0 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 684] <... close resumed>) = 0 [pid 299] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] newfstatat(AT_FDCWD, "./12/binderfs", [pid 297] newfstatat(AT_FDCWD, "./12/binderfs", [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] unlink("./12/binderfs" [pid 297] unlink("./12/binderfs" [pid 299] <... unlink resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 299] getdents64(3, [pid 297] getdents64(3, [pid 684] symlink("/dev/binderfs", "./binderfs" [pid 683] <... futex resumed>) = 1 [pid 677] <... futex resumed>) = 0 [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] openat(AT_FDCWD, "./12/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 684] <... symlink resumed>) = 0 [pid 683] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 677] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 299] close(3 [pid 297] close(3 [pid 684] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 683] <... write resumed>) = 1045 [pid 677] <... futex resumed>) = 0 [pid 299] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [pid 295] <... openat resumed>) = 4 [pid 684] <... futex resumed>) = 0 [pid 683] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 677] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 673] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 299] rmdir("./12" [pid 297] rmdir("./12" [pid 299] <... rmdir resumed>) = 0 [pid 297] <... rmdir resumed>) = 0 [pid 299] mkdir("./13", 0777 [pid 297] mkdir("./13", 0777 [pid 299] <... mkdir resumed>) = 0 [pid 297] <... mkdir resumed>) = 0 [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 299] <... openat resumed>) = 3 [pid 297] <... openat resumed>) = 3 [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] ioctl(3, LOOP_CLR_FD [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 299] close(3 [pid 297] close(3 [pid 299] <... close resumed>) = 0 [pid 297] <... close resumed>) = 0 [ 26.429025][ T673] EXT4-fs (loop2): 1 orphan inode deleted [ 26.434600][ T673] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 26.448096][ T673] ext4 filesystem being mounted at /root/syzkaller.rVgsXW/12/file1 supports timestamps until 2038 (0x7fffffff) [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 688 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 689 ./strace-static-x86_64: Process 688 attached [pid 688] set_robust_list(0x555556d8d6a0, 24./strace-static-x86_64: Process 689 attached [pid 689] set_robust_list(0x555556d8d6a0, 24 [pid 688] <... set_robust_list resumed>) = 0 [pid 689] <... set_robust_list resumed>) = 0 [pid 689] chdir("./13" [pid 688] chdir("./13") = 0 [pid 689] <... chdir resumed>) = 0 [pid 689] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 688] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 689] <... prctl resumed>) = 0 [pid 688] <... prctl resumed>) = 0 [pid 689] setpgid(0, 0 [pid 688] setpgid(0, 0 [pid 689] <... setpgid resumed>) = 0 [pid 688] <... setpgid resumed>) = 0 [pid 689] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 688] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 684] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 677] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 295] newfstatat(4, "", [pid 689] <... openat resumed>) = 3 [pid 688] <... openat resumed>) = 3 [pid 684] <... rt_sigaction resumed>NULL, 8) = 0 [pid 683] <... futex resumed>) = 0 [pid 673] ioctl(5, LOOP_CLR_FD [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 689] write(3, "1000", 4 [pid 688] write(3, "1000", 4 [pid 684] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 683] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 295] getdents64(4, [pid 689] <... write resumed>) = 4 [pid 688] <... write resumed>) = 4 [pid 684] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 689] close(3 [pid 688] close(3 [pid 684] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 295] <... getdents64 resumed>0x555556d96770 /* 2 entries */, 32768) = 48 [pid 689] <... close resumed>) = 0 [pid 688] <... close resumed>) = 0 [pid 684] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 295] getdents64(4, [pid 689] symlink("/dev/binderfs", "./binderfs" [pid 688] symlink("/dev/binderfs", "./binderfs" [pid 684] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 295] <... getdents64 resumed>0x555556d96770 /* 0 entries */, 32768) = 0 [pid 689] <... symlink resumed>) = 0 [pid 688] <... symlink resumed>) = 0 [pid 684] <... mprotect resumed>) = 0 [pid 295] close(4 [pid 689] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 684] rt_sigprocmask(SIG_BLOCK, ~[], [pid 295] <... close resumed>) = 0 [pid 689] <... futex resumed>) = 0 [pid 688] <... futex resumed>) = 0 [pid 684] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] rmdir("./12/file1" [pid 689] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 688] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 684] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 689] <... rt_sigaction resumed>NULL, 8) = 0 [pid 688] <... rt_sigaction resumed>NULL, 8) = 0 [pid 295] <... rmdir resumed>) = 0 [pid 689] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 688] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 684] <... clone3 resumed> => {parent_tid=[690]}, 88) = 690 [pid 295] getdents64(3, [pid 689] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 688] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 684] rt_sigprocmask(SIG_SETMASK, [], [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 ./strace-static-x86_64: Process 690 attached [pid 689] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 688] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 684] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 689] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 688] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 689] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 688] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 689] <... mprotect resumed>) = 0 [pid 688] <... mprotect resumed>) = 0 [pid 689] rt_sigprocmask(SIG_BLOCK, ~[], [pid 688] rt_sigprocmask(SIG_BLOCK, ~[], [pid 689] <... rt_sigprocmask resumed>[], 8) = 0 [pid 688] <... rt_sigprocmask resumed>[], 8) = 0 [pid 689] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 688] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 690] set_robust_list(0x7f0c4a20e9a0, 24 [pid 684] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] close(3 [pid 689] <... clone3 resumed> => {parent_tid=[691]}, 88) = 691 [pid 688] <... clone3 resumed> => {parent_tid=[692]}, 88) = 692 [pid 689] rt_sigprocmask(SIG_SETMASK, [], [pid 688] rt_sigprocmask(SIG_SETMASK, [], [pid 689] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 688] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 689] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 689] <... futex resumed>) = 0 [pid 688] <... futex resumed>) = 0 [pid 689] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 689] <... futex resumed>) = 0 [pid 688] <... futex resumed>) = 0 [pid 689] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 688] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 690] <... set_robust_list resumed>) = 0 [pid 689] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 688] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 684] <... futex resumed>) = 0 [pid 295] <... close resumed>) = 0 [pid 690] rt_sigprocmask(SIG_SETMASK, [], [pid 689] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 688] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 684] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 673] <... ioctl resumed>) = 0 [pid 689] <... mprotect resumed>) = 0 [pid 688] <... mprotect resumed>) = 0 [pid 673] close(5 [pid 690] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 689] rt_sigprocmask(SIG_BLOCK, ~[], [pid 688] rt_sigprocmask(SIG_BLOCK, ~[], [pid 684] <... futex resumed>) = 0 [pid 673] <... close resumed>) = 0 [pid 295] rmdir("./12"./strace-static-x86_64: Process 692 attached [pid 689] <... rt_sigprocmask resumed>[], 8) = 0 [pid 688] <... rt_sigprocmask resumed>[], 8) = 0 [pid 673] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 692] set_robust_list(0x7f0c4a20e9a0, 24 [pid 689] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 688] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 673] <... futex resumed>) = 0 [pid 667] exit_group(0./strace-static-x86_64: Process 691 attached [pid 692] <... set_robust_list resumed>) = 0 [pid 690] memfd_create("syzkaller", 0 [pid 684] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 667] <... exit_group resumed>) = ? [pid 692] rt_sigprocmask(SIG_SETMASK, [], [pid 691] set_robust_list(0x7f0c4a20e9a0, 24 [pid 690] <... memfd_create resumed>) = 3 [pid 689] <... clone3 resumed> => {parent_tid=[693]}, 88) = 693 [pid 688] <... clone3 resumed> => {parent_tid=[694]}, 88) = 694 [pid 684] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 674] <... futex resumed>) = ? [pid 673] +++ exited with 0 +++ [pid 295] <... rmdir resumed>) = 0 [pid 692] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 691] <... set_robust_list resumed>) = 0 [pid 690] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 689] rt_sigprocmask(SIG_SETMASK, [], [pid 688] rt_sigprocmask(SIG_SETMASK, [], [pid 684] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 692] memfd_create("syzkaller", 0 [pid 691] rt_sigprocmask(SIG_SETMASK, [], [pid 690] <... mmap resumed>) = 0x7f0c41dcd000 [pid 689] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 688] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 684] <... mprotect resumed>) = 0 [pid 674] +++ exited with 0 +++ [pid 667] +++ exited with 0 +++ [pid 295] mkdir("./13", 0777 [pid 692] <... memfd_create resumed>) = 3 [pid 691] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 689] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 684] rt_sigprocmask(SIG_BLOCK, ~[], [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=667, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 692] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 691] memfd_create("syzkaller", 0 [pid 689] <... futex resumed>) = 0 [pid 688] <... futex resumed>) = 0 [pid 295] <... mkdir resumed>) = 0 [pid 690] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 692] <... mmap resumed>) = 0x7f0c41dcd000 [pid 691] <... memfd_create resumed>) = 3 [pid 689] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 688] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 684] <... rt_sigprocmask resumed>[], 8) = 0 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 692] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 691] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 690] <... write resumed>) = 262144 [pid 684] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 296] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... openat resumed>) = 3 ./strace-static-x86_64: Process 694 attached ./strace-static-x86_64: Process 693 attached [pid 692] <... write resumed>) = 262144 [pid 691] <... mmap resumed>) = 0x7f0c41dcd000 [pid 690] munmap(0x7f0c41dcd000, 138412032 [pid 680] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] ioctl(3, LOOP_CLR_FD [pid 694] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 693] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 690] <... munmap resumed>) = 0 [pid 684] <... clone3 resumed> => {parent_tid=[695]}, 88) = 695 [pid 680] ioctl(4, LOOP_CLR_FD [pid 296] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 694] <... set_robust_list resumed>) = 0 [pid 693] <... set_robust_list resumed>) = 0 [pid 690] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 684] rt_sigprocmask(SIG_SETMASK, [], [pid 680] <... ioctl resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 295] close(3./strace-static-x86_64: Process 695 attached [pid 694] rt_sigprocmask(SIG_SETMASK, [], [pid 693] rt_sigprocmask(SIG_SETMASK, [], [pid 692] munmap(0x7f0c41dcd000, 138412032 [pid 691] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 690] <... openat resumed>) = 4 [pid 684] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 680] close(4 [pid 296] newfstatat(3, "", [pid 295] <... close resumed>) = 0 [pid 695] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 692] <... munmap resumed>) = 0 [pid 691] <... write resumed>) = 262144 [pid 690] ioctl(4, LOOP_SET_FD, 3 [pid 684] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 680] <... close resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [ 26.492377][ T680] EXT4-fs error (device loop4): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 26.518216][ T680] EXT4-fs (loop4): get root inode failed [ 26.523832][ T680] EXT4-fs (loop4): mount failed [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 695] <... set_robust_list resumed>) = 0 [pid 693] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 692] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 691] munmap(0x7f0c41dcd000, 138412032 [pid 296] getdents64(3, [pid 695] rt_sigprocmask(SIG_SETMASK, [], [pid 692] <... openat resumed>) = 4 [pid 691] <... munmap resumed>) = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 695] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 692] ioctl(4, LOOP_SET_FD, 3 [pid 691] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 296] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW./strace-static-x86_64: Process 696 attached [pid 694] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 693] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 690] <... ioctl resumed>) = 0 [pid 684] <... futex resumed>) = 0 [pid 680] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] set_robust_list(0x555556d8d6a0, 24 [pid 695] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 694] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 693] <... open resumed>) = 4 [pid 691] <... openat resumed>) = 5 [pid 690] close(3 [pid 684] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 680] <... futex resumed>) = 0 [pid 692] <... ioctl resumed>) = 0 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 696 [pid 696] <... set_robust_list resumed>) = 0 [pid 694] <... open resumed>) = 5 [pid 693] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 690] <... close resumed>) = 0 [pid 680] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 696] chdir("./13" [pid 694] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] <... futex resumed>) = 1 [pid 691] ioctl(5, LOOP_SET_FD, 3 [pid 690] mkdir("./bus", 0777 [pid 296] newfstatat(AT_FDCWD, "./12/binderfs", [pid 696] <... chdir resumed>) = 0 [pid 695] <... open resumed>) = 3 [pid 694] <... futex resumed>) = 1 [pid 693] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 690] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 689] <... futex resumed>) = 0 [pid 688] <... futex resumed>) = 0 [pid 677] exit_group(0 [pid 696] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 694] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 690] mount("/dev/loop0", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 683] <... futex resumed>) = ? [pid 680] <... futex resumed>) = ? [pid 677] <... exit_group resumed>) = ? [pid 696] <... prctl resumed>) = 0 [pid 695] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 692] close(3 [pid 691] <... ioctl resumed>) = 0 [pid 689] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 683] +++ exited with 0 +++ [pid 680] +++ exited with 0 +++ [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 696] setpgid(0, 0 [pid 695] <... futex resumed>) = 1 [pid 694] <... futex resumed>) = 0 [pid 693] <... futex resumed>) = 0 [pid 692] <... close resumed>) = 0 [pid 691] close(3 [pid 689] <... futex resumed>) = 1 [pid 688] <... futex resumed>) = 1 [pid 684] <... futex resumed>) = 0 [pid 296] unlink("./12/binderfs" [pid 696] <... setpgid resumed>) = 0 [pid 695] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 694] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 693] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 689] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 684] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 695] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 694] <... mount resumed>) = 0 [pid 693] <... mount resumed>) = 0 [pid 692] mkdir("./bus", 0777 [pid 691] <... close resumed>) = 0 [pid 688] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 684] <... futex resumed>) = 0 [pid 296] <... unlink resumed>) = 0 [pid 696] <... openat resumed>) = 3 [pid 695] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL [pid 694] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 684] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] umount2("./12/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 696] write(3, "1000", 4 [pid 695] <... mount resumed>) = 0 [pid 694] <... futex resumed>) = 0 [pid 693] <... futex resumed>) = 1 [pid 689] <... futex resumed>) = 0 [pid 688] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 696] <... write resumed>) = 4 [pid 695] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 694] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 693] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 689] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] <... futex resumed>) = 0 [pid 296] newfstatat(AT_FDCWD, "./12/file1", [pid 696] close(3 [pid 695] <... futex resumed>) = 1 [pid 694] <... open resumed>) = 3 [pid 693] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 689] <... futex resumed>) = 0 [pid 688] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 684] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 696] <... close resumed>) = 0 [pid 695] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 694] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 689] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 688] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 684] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] unlink("./12/file1" [pid 696] symlink("/dev/binderfs", "./binderfs" [pid 695] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 694] <... futex resumed>) = 0 [pid 693] <... open resumed>) = 3 [pid 688] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 684] <... futex resumed>) = 0 [pid 696] <... symlink resumed>) = 0 [pid 695] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 694] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 693] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 688] <... futex resumed>) = 0 [pid 684] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... unlink resumed>) = 0 [pid 696] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 695] <... open resumed>) = 5 [pid 694] <... write resumed>) = 8 [pid 693] <... futex resumed>) = 1 [pid 692] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 691] mkdir("./bus", 0777 [pid 689] <... futex resumed>) = 0 [pid 688] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] getdents64(3, [pid 696] <... futex resumed>) = 0 [pid 695] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 694] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] write(3, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 692] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 691] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 689] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 696] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 695] <... futex resumed>) = 1 [pid 691] mount("/dev/loop3", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 684] <... futex resumed>) = 0 [pid 296] close(3 [pid 695] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 296] <... close resumed>) = 0 [pid 296] rmdir("./12") = 0 [pid 296] mkdir("./13", 0777) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR) = 3 [pid 296] ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address) [pid 296] close(3) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555556d8d690) = 699 [pid 694] <... futex resumed>) = 1 [pid 688] <... futex resumed>) = 0 [pid 694] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 688] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 694] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 688] <... futex resumed>) = 0 [pid 694] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 688] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 689] <... futex resumed>) = 0 [ 26.552013][ T690] loop0: detected capacity change from 0 to 512 [ 26.555329][ T692] loop5: detected capacity change from 0 to 512 [ 26.566637][ T691] loop3: detected capacity change from 0 to 512 [ 26.582027][ T690] EXT4-fs (loop0): 1 orphan inode deleted [ 26.587604][ T690] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [pid 689] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 699 attached [pid 696] <... rt_sigaction resumed>NULL, 8) = 0 [pid 694] <... write resumed>) = 1045 [pid 693] <... write resumed>) = 8 [pid 684] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 694] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 694] <... futex resumed>) = 1 [pid 693] <... futex resumed>) = 1 [pid 689] <... futex resumed>) = 0 [pid 688] <... futex resumed>) = 0 [pid 694] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 693] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 689] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 693] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 689] <... futex resumed>) = 0 [pid 693] write(3, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 689] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 693] <... write resumed>) = 1045 [pid 693] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 689] <... futex resumed>) = 0 [pid 693] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 699] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 699] chdir("./13") = 0 [pid 699] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 699] setpgid(0, 0) = 0 [pid 699] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 696] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 695] <... futex resumed>) = 0 [pid 684] <... futex resumed>) = 1 [pid 699] write(3, "1000", 4 [pid 696] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 695] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 692] <... mount resumed>) = -1 EINVAL (Invalid argument) [pid 684] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 696] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 695] <... write resumed>) = 8 [pid 692] ioctl(4, LOOP_CLR_FD [pid 696] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 695] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 692] <... ioctl resumed>) = 0 [pid 696] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 695] <... futex resumed>) = 1 [pid 692] close(4 [pid 684] <... futex resumed>) = 0 [pid 696] <... mprotect resumed>) = 0 [pid 695] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 692] <... close resumed>) = 0 [pid 684] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 699] <... write resumed>) = 4 [pid 696] rt_sigprocmask(SIG_BLOCK, ~[], [pid 695] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 692] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 684] <... futex resumed>) = 0 [pid 677] +++ exited with 0 +++ [pid 699] close(3 [pid 696] <... rt_sigprocmask resumed>[], 8) = 0 [pid 695] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 692] <... futex resumed>) = 0 [pid 684] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=677, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 699] <... close resumed>) = 0 [pid 696] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 695] <... write resumed>) = 1045 [pid 692] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 688] exit_group(0 [pid 699] symlink("/dev/binderfs", "./binderfs" [pid 695] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 694] <... futex resumed>) = ? [pid 692] <... futex resumed>) = ? [pid 688] <... exit_group resumed>) = ? [pid 699] <... symlink resumed>) = 0 [pid 696] <... clone3 resumed> => {parent_tid=[702]}, 88) = 702 [pid 695] <... futex resumed>) = 1 [pid 694] +++ exited with 0 +++ [pid 692] +++ exited with 0 +++ [pid 690] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 684] <... futex resumed>) = 0 [pid 298] umount2("./12", MNT_DETACH|UMOUNT_NOFOLLOW [pid 699] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] rt_sigprocmask(SIG_SETMASK, [], [pid 695] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 690] ioctl(4, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 699] <... futex resumed>) = 0 [pid 696] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 690] <... ioctl resumed>) = 0 [pid 298] openat(AT_FDCWD, "./12", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 699] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 696] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 690] close(4 [pid 298] <... openat resumed>) = 3 [pid 699] <... rt_sigaction resumed>NULL, 8) = 0 [pid 696] <... futex resumed>) = 0 [pid 298] newfstatat(3, "", [pid 699] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 696] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 699] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 696] <... futex resumed>) = 0 [pid 298] getdents64(3, [pid 699] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 696] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 699] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 696] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 298] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 699] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 696] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 699] <... mprotect resumed>) = 0 [pid 696] <... mprotect resumed>) = 0 [pid 699] rt_sigprocmask(SIG_BLOCK, ~[], [pid 696] rt_sigprocmask(SIG_BLOCK, ~[], [pid 699] <... rt_sigprocmask resumed>[], 8) = 0 [pid 696] <... rt_sigprocmask resumed>[], 8) = 0 [pid 699] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 696] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 298] <... umount2 resumed>) = 0 ./strace-static-x86_64: Process 704 attached ./strace-static-x86_64: Process 703 attached ./strace-static-x86_64: Process 702 attached [pid 699] <... clone3 resumed> => {parent_tid=[703]}, 88) = 703 [pid 696] <... clone3 resumed> => {parent_tid=[704]}, 88) = 704 [pid 690] <... close resumed>) = 0 [ 26.597719][ T692] EXT4-fs (loop5): Invalid log block size: 2475723007 [ 26.598667][ T690] ext4 filesystem being mounted at /root/syzkaller.iF59aB/13/bus supports timestamps until 2038 (0x7fffffff) [ 26.617486][ T691] EXT4-fs error (device loop3): __ext4_get_inode_loc:4340: comm syz-executor170: Invalid inode table block 34 in block_group 0 [ 26.646495][ T691] EXT4-fs (loop3): get root inode failed [pid 298] umount2("./12/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 699] rt_sigprocmask(SIG_SETMASK, [], [pid 696] rt_sigprocmask(SIG_SETMASK, [], [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 699] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 696] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 298] newfstatat(AT_FDCWD, "./12/bus", [pid 699] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 699] <... futex resumed>) = 0 [pid 696] <... futex resumed>) = 0 [pid 298] unlink("./12/bus" [pid 699] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... unlink resumed>) = 0 [pid 699] <... futex resumed>) = 0 [pid 298] umount2("./12/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 699] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 704] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 703] set_robust_list(0x7f0c4a20e9a0, 24 [pid 702] set_robust_list(0x7f0c4a20e9a0, 24 [pid 699] <... mmap resumed>) = 0x7f0c4a1cd000 [pid 690] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 684] exit_group(0 [pid 298] newfstatat(AT_FDCWD, "./12/binderfs", [pid 704] <... set_robust_list resumed>) = 0 [pid 703] <... set_robust_list resumed>) = 0 [pid 702] <... set_robust_list resumed>) = 0 [pid 699] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE [pid 695] <... futex resumed>) = ? [pid 690] <... futex resumed>) = ? [pid 684] <... exit_group resumed>) = ? [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 691] <... mount resumed>) = -1 EUCLEAN (Structure needs cleaning) [pid 704] rt_sigprocmask(SIG_SETMASK, [], [pid 703] rt_sigprocmask(SIG_SETMASK, [], [pid 702] rt_sigprocmask(SIG_SETMASK, [], [pid 699] <... mprotect resumed>) = 0 [pid 695] +++ exited with 0 +++ [pid 690] +++ exited with 0 +++ [pid 298] unlink("./12/binderfs" [pid 704] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 703] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 702] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 699] rt_sigprocmask(SIG_BLOCK, ~[], [pid 691] ioctl(5, LOOP_CLR_FD [pid 704] open("./file1", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 703] memfd_create("syzkaller", 0 [pid 702] memfd_create("syzkaller", 0 [pid 699] <... rt_sigprocmask resumed>[], 8) = 0 [pid 691] <... ioctl resumed>) = 0 [pid 298] <... unlink resumed>) = 0 [pid 704] <... open resumed>) = 3 [pid 703] <... memfd_create resumed>) = 3 [pid 702] <... memfd_create resumed>) = 4 [pid 699] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} [pid 691] close(5 [pid 298] getdents64(3, [pid 704] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 703] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 702] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 691] <... close resumed>) = 0 [pid 704] <... futex resumed>) = 1 [pid 703] <... mmap resumed>) = 0x7f0c41dcd000 [pid 702] <... mmap resumed>) = 0x7f0c41dcd000 [pid 699] <... clone3 resumed> => {parent_tid=[705]}, 88) = 705 [pid 696] <... futex resumed>) = 0 [pid 691] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3./strace-static-x86_64: Process 705 attached [pid 704] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 699] rt_sigprocmask(SIG_SETMASK, [], [pid 696] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 691] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 705] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 699] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 696] <... futex resumed>) = 0 [pid 691] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] rmdir("./12" [pid 705] <... set_robust_list resumed>) = 0 [pid 703] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 699] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] <... rmdir resumed>) = 0 [pid 705] rt_sigprocmask(SIG_SETMASK, [], [pid 699] <... futex resumed>) = 0 [pid 689] exit_group(0 [pid 298] mkdir("./13", 0777 [pid 705] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 704] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 702] write(4, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 699] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 691] <... futex resumed>) = ? [pid 689] <... exit_group resumed>) = ? [pid 298] <... mkdir resumed>) = 0 [pid 705] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 704] mount("/dev/loop1", "./bus", NULL, MS_BIND, NULL [pid 693] <... futex resumed>) = ? [pid 691] +++ exited with 0 +++ [pid 298] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 705] <... open resumed>) = 4 [pid 298] <... openat resumed>) = 3 [pid 705] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] ioctl(3, LOOP_CLR_FD [pid 705] <... futex resumed>) = 1 [pid 699] <... futex resumed>) = 0 [pid 298] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 705] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 699] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] close(3 [pid 705] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 699] <... futex resumed>) = 0 [pid 298] <... close resumed>) = 0 [pid 705] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 704] <... mount resumed>) = -1 ENOENT (No such file or directory) [pid 699] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 298] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 705] <... mount resumed>) = 0 [pid 704] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 703] <... write resumed>) = 262144 [pid 702] <... write resumed>) = 262144 [pid 704] <... futex resumed>) = 1 [pid 703] munmap(0x7f0c41dcd000, 138412032 [pid 702] munmap(0x7f0c41dcd000, 138412032./strace-static-x86_64: Process 706 attached [pid 705] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 704] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 703] <... munmap resumed>) = 0 [pid 696] <... futex resumed>) = 0 [pid 706] set_robust_list(0x555556d8d6a0, 24 [pid 705] <... futex resumed>) = 1 [pid 704] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 703] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 702] <... munmap resumed>) = 0 [pid 699] <... futex resumed>) = 0 [pid 696] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] <... clone resumed>, child_tidptr=0x555556d8d690) = 706 [pid 706] <... set_robust_list resumed>) = 0 [pid 705] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 704] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 703] <... openat resumed>) = 5 [pid 702] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 699] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] <... futex resumed>) = 0 [pid 706] chdir("./13" [pid 705] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 704] <... open resumed>) = -1 ENOENT (No such file or directory) [pid 703] ioctl(5, LOOP_SET_FD, 3 [pid 702] <... openat resumed>) = 5 [pid 699] <... futex resumed>) = 0 [pid 696] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 706] <... chdir resumed>) = 0 [pid 705] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 704] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 699] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 696] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 706] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 696] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 706] <... prctl resumed>) = 0 [pid 696] <... futex resumed>) = 0 [pid 706] setpgid(0, 0 [pid 696] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 706] <... setpgid resumed>) = 0 [pid 706] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 706] write(3, "1000", 4) = 4 [pid 706] close(3) = 0 [pid 706] symlink("/dev/binderfs", "./binderfs") = 0 [pid 706] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 706] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 706] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 706] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 706] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 706] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 706] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[707]}, 88) = 707 [pid 706] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 706] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 706] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 706] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 706] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 706] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 706] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[708]}, 88) = 708 [pid 706] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 706] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 706] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 708 attached [pid 708] set_robust_list(0x7f0c4a1ed9a0, 24) = 0 [pid 708] rt_sigprocmask(SIG_SETMASK, [], [pid 704] <... futex resumed>) = 1 [pid 702] ioctl(5, LOOP_SET_FD, 4 [pid 696] <... futex resumed>) = 0 [pid 704] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 EBADF (Bad file descriptor) [pid 696] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=44000000} [pid 704] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 708] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 708] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 708] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 706] <... futex resumed>) = 0 [pid 706] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 706] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 708] <... futex resumed>) = 1 [pid 708] mount("/dev/loop4", "./bus", NULL, MS_BIND, NULL) = 0 [pid 708] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 706] <... futex resumed>) = 0 [pid 706] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 706] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 708] <... futex resumed>) = 1 [pid 708] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = 4 [pid 708] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 706] <... futex resumed>) = 0 [pid 706] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 706] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 708] <... futex resumed>) = 1 [pid 708] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8) = -1 ENOSPC (No space left on device) [pid 708] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 706] <... futex resumed>) = 0 [pid 706] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 706] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 708] <... futex resumed>) = 1 [pid 708] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045) = -1 ENOSPC (No space left on device) [pid 708] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 706] <... futex resumed>) = 0 [pid 708] <... futex resumed>) = 1 [pid 708] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 705] <... open resumed>) = 6 [pid 705] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 699] <... futex resumed>) = 0 [pid 705] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 699] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 705] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 699] <... futex resumed>) = 0 [pid 705] write(6, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 699] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 704] <... futex resumed>) = 0 [pid 696] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 703] <... ioctl resumed>) = 0 [pid 703] close(3) = 0 [pid 696] <... futex resumed>) = 0 [pid 704] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 705] <... write resumed>) = 8 [pid 704] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 696] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 705] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 704] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 696] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 705] <... futex resumed>) = 1 [pid 704] <... futex resumed>) = 0 [pid 699] <... futex resumed>) = 0 [pid 705] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 704] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 699] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 705] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 699] <... futex resumed>) = 0 [pid 705] write(6, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 699] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 705] <... write resumed>) = 1045 [pid 705] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 699] <... futex resumed>) = 0 [pid 705] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 703] mkdir("./bus", 0777) = -1 EEXIST (File exists) [pid 703] mount("/dev/loop2", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue"./strace-static-x86_64: Process 707 attached [pid 702] <... ioctl resumed>) = 0 [pid 702] close(4 [pid 707] set_robust_list(0x7f0c4a20e9a0, 24) = 0 [pid 702] <... close resumed>) = 0 [pid 688] +++ exited with 0 +++ [pid 684] +++ exited with 0 +++ [pid 299] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=688, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 299] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=684, si_uid=0, si_status=0, si_utime=0, si_stime=4} --- [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 299] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 299] newfstatat(3, "", {st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] getdents64(3, [pid 693] +++ exited with 0 +++ [pid 689] +++ exited with 0 +++ [pid 299] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 299] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=689, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 294] <... restart_syscall resumed>) = 0 [pid 299] <... umount2 resumed>) = 0 [pid 297] restart_syscall(<... resuming interrupted clone ...> [pid 299] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... restart_syscall resumed>) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] newfstatat(AT_FDCWD, "./13/bus", [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 299] unlink("./13/bus" [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... openat resumed>) = 3 [pid 299] <... unlink resumed>) = 0 [pid 297] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 294] newfstatat(3, "", [pid 299] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] <... openat resumed>) = 3 [pid 294] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 299] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] newfstatat(3, "", [pid 294] getdents64(3, [pid 299] newfstatat(AT_FDCWD, "./13/binderfs", [pid 297] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 299] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 297] getdents64(3, [pid 294] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] unlink("./13/binderfs" [pid 297] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 702] mkdir("./file1", 0777 [pid 299] <... unlink resumed>) = 0 [pid 297] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] <... umount2 resumed>) = 0 [pid 299] getdents64(3, [pid 294] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 702] <... mkdir resumed>) = -1 EEXIST (File exists) [pid 299] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 297] <... umount2 resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] close(3 [pid 297] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] newfstatat(AT_FDCWD, "./13/bus", [pid 702] mount("/dev/loop1", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 299] <... close resumed>) = 0 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] rmdir("./13" [pid 297] newfstatat(AT_FDCWD, "./13/bus", [pid 294] unlink("./13/bus" [pid 299] <... rmdir resumed>) = 0 [pid 297] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... unlink resumed>) = 0 [pid 299] mkdir("./14", 0777 [pid 297] unlink("./13/bus" [pid 294] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 299] <... mkdir resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 294] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 299] openat(AT_FDCWD, "/dev/loop5", O_RDWR [pid 297] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] newfstatat(AT_FDCWD, "./13/binderfs", [pid 299] <... openat resumed>) = 3 [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 299] ioctl(3, LOOP_CLR_FD [pid 297] newfstatat(AT_FDCWD, "./13/binderfs", [pid 294] unlink("./13/binderfs" [pid 707] rt_sigprocmask(SIG_SETMASK, [], [pid 299] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 294] <... unlink resumed>) = 0 [pid 299] close(3 [pid 297] unlink("./13/binderfs" [pid 294] getdents64(3, [pid 299] <... close resumed>) = 0 [pid 297] <... unlink resumed>) = 0 [pid 294] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 299] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 297] getdents64(3, [pid 294] close(3 [pid 707] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 297] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 294] <... close resumed>) = 0 [pid 299] <... clone resumed>, child_tidptr=0x555556d8d690) = 709 [pid 297] close(3 [pid 294] rmdir("./13"./strace-static-x86_64: Process 709 attached [pid 707] memfd_create("syzkaller", 0 [pid 297] <... close resumed>) = 0 [pid 294] <... rmdir resumed>) = 0 [ 26.652681][ T691] EXT4-fs (loop3): mount failed [ 26.672737][ T703] loop2: detected capacity change from 0 to 512 [ 26.679324][ T702] loop1: detected capacity change from 0 to 512 [ 26.690983][ T703] EXT4-fs (loop2): Invalid log block size: 2475723007 [pid 709] set_robust_list(0x555556d8d6a0, 24 [pid 707] <... memfd_create resumed>) = 5 [pid 297] rmdir("./13" [pid 294] mkdir("./14", 0777 [pid 709] <... set_robust_list resumed>) = 0 [pid 707] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 297] <... rmdir resumed>) = 0 [pid 294] <... mkdir resumed>) = 0 [pid 297] mkdir("./14", 0777 [pid 294] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 297] <... mkdir resumed>) = 0 [pid 294] <... openat resumed>) = 3 [pid 297] openat(AT_FDCWD, "/dev/loop3", O_RDWR [pid 294] ioctl(3, LOOP_CLR_FD [pid 297] <... openat resumed>) = 3 [pid 294] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 297] ioctl(3, LOOP_CLR_FD [pid 294] close(3 [pid 297] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 294] <... close resumed>) = 0 [pid 297] close(3 [pid 294] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 709] chdir("./14" [pid 707] <... mmap resumed>) = 0x7f0c41dcd000 [pid 297] <... close resumed>) = 0 [pid 297] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 294] <... clone resumed>, child_tidptr=0x555556d8d690) = 712 [pid 297] <... clone resumed>, child_tidptr=0x555556d8d690) = 713 ./strace-static-x86_64: Process 712 attached [pid 712] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 712] chdir("./14") = 0 [pid 712] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 712] setpgid(0, 0 [pid 707] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 709] <... chdir resumed>) = 0 [pid 712] <... setpgid resumed>) = 0 [pid 709] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 712] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 712] write(3, "1000", 4) = 4 [pid 712] close(3) = 0 [pid 712] symlink("/dev/binderfs", "./binderfs" [pid 709] <... prctl resumed>) = 0 [pid 709] setpgid(0, 0) = 0 [pid 709] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 712] <... symlink resumed>) = 0 [pid 709] <... openat resumed>) = 3 ./strace-static-x86_64: Process 713 attached [pid 709] write(3, "1000", 4 [pid 713] set_robust_list(0x555556d8d6a0, 24 [pid 709] <... write resumed>) = 4 [pid 713] <... set_robust_list resumed>) = 0 [pid 712] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 707] <... write resumed>) = 262144 [pid 713] chdir("./14" [pid 712] <... futex resumed>) = 0 [pid 713] <... chdir resumed>) = 0 [pid 712] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 709] close(3 [pid 713] prctl(PR_SET_PDEATHSIG, SIGKILL [pid 712] <... rt_sigaction resumed>NULL, 8) = 0 [pid 713] <... prctl resumed>) = 0 [pid 712] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 709] <... close resumed>) = 0 [pid 707] munmap(0x7f0c41dcd000, 138412032 [pid 713] setpgid(0, 0 [pid 712] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 709] symlink("/dev/binderfs", "./binderfs" [pid 713] <... setpgid resumed>) = 0 [pid 712] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 713] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC [pid 712] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 713] <... openat resumed>) = 3 [pid 712] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 709] <... symlink resumed>) = 0 [pid 713] write(3, "1000", 4 [pid 712] <... mprotect resumed>) = 0 [pid 707] <... munmap resumed>) = 0 [pid 713] <... write resumed>) = 4 [pid 712] rt_sigprocmask(SIG_BLOCK, ~[], [pid 713] close(3 [pid 712] <... rt_sigprocmask resumed>[], 8) = 0 [pid 713] <... close resumed>) = 0 [pid 712] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 713] symlink("/dev/binderfs", "./binderfs") = 0 [pid 712] <... clone3 resumed> => {parent_tid=[714]}, 88) = 714 [pid 713] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 712] rt_sigprocmask(SIG_SETMASK, [], [pid 713] <... futex resumed>) = 0 [pid 712] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 713] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 712] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 713] <... rt_sigaction resumed>NULL, 8) = 0 [pid 712] <... futex resumed>) = 0 [pid 709] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 707] openat(AT_FDCWD, "/dev/loop4", O_RDWR [pid 703] <... mount resumed>) = -1 EINVAL (Invalid argument) [ 26.711142][ T702] EXT4-fs (loop1): 1 orphan inode deleted [ 26.716700][ T702] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 26.739011][ T702] ext4 filesystem being mounted at /root/syzkaller.jAi0v3/13/file1 supports timestamps until 2038 (0x7fffffff) [pid 713] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 712] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 709] <... futex resumed>) = 0 [pid 707] <... openat resumed>) = 6 [pid 703] ioctl(5, LOOP_CLR_FD./strace-static-x86_64: Process 714 attached [pid 709] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 707] ioctl(6, LOOP_SET_FD, 5 [pid 714] set_robust_list(0x7f0c4a20e9a0, 24 [pid 709] <... rt_sigaction resumed>NULL, 8) = 0 [pid 707] <... ioctl resumed>) = 0 [pid 714] <... set_robust_list resumed>) = 0 [pid 709] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 714] rt_sigprocmask(SIG_SETMASK, [], [pid 709] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 714] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 709] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 714] memfd_create("syzkaller", 0 [pid 709] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 707] close(5 [pid 714] <... memfd_create resumed>) = 3 [pid 709] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 714] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 709] <... mprotect resumed>) = 0 [pid 707] <... close resumed>) = 0 [pid 714] <... mmap resumed>) = 0x7f0c41dee000 [pid 709] rt_sigprocmask(SIG_BLOCK, ~[], [pid 714] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 713] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 712] <... futex resumed>) = 0 [pid 709] <... rt_sigprocmask resumed>[], 8) = 0 [pid 707] mkdir("./file1", 0777 [pid 703] <... ioctl resumed>) = 0 [pid 713] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 712] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 709] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 707] <... mkdir resumed>) = 0 [pid 703] close(5./strace-static-x86_64: Process 715 attached [pid 713] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 712] <... mmap resumed>) = 0x7f0c41dcd000 [pid 707] mount("/dev/loop4", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 714] <... write resumed>) = 262144 [pid 713] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 712] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 709] <... clone3 resumed> => {parent_tid=[715]}, 88) = 715 [pid 715] set_robust_list(0x7f0c4a20e9a0, 24 [pid 703] <... close resumed>) = 0 [pid 702] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 715] <... set_robust_list resumed>) = 0 [pid 714] munmap(0x7f0c41dee000, 138412032 [pid 709] rt_sigprocmask(SIG_SETMASK, [], [pid 713] <... mprotect resumed>) = 0 [pid 712] <... mprotect resumed>) = 0 [pid 703] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 702] ioctl(5, LOOP_CLR_FD [pid 715] rt_sigprocmask(SIG_SETMASK, [], [pid 714] <... munmap resumed>) = 0 [pid 709] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 715] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 714] openat(AT_FDCWD, "/dev/loop0", O_RDWR [pid 709] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 715] memfd_create("syzkaller", 0 [pid 714] <... openat resumed>) = 4 [pid 709] <... futex resumed>) = 0 [pid 715] <... memfd_create resumed>) = 3 [pid 714] ioctl(4, LOOP_SET_FD, 3 [ 26.760282][ T707] loop4: detected capacity change from 0 to 512 [ 26.780281][ T707] EXT4-fs (loop4): 1 orphan inode deleted [ 26.786528][ T707] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 26.788327][ T714] loop0: detected capacity change from 0 to 512 [pid 709] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 715] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 713] rt_sigprocmask(SIG_BLOCK, ~[], [pid 712] rt_sigprocmask(SIG_BLOCK, ~[], [pid 709] <... futex resumed>) = 0 [pid 703] <... futex resumed>) = 0 [pid 699] exit_group(0 [pid 715] <... mmap resumed>) = 0x7f0c41dee000 [pid 709] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 705] <... futex resumed>) = ? [pid 699] <... exit_group resumed>) = ? [pid 715] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 709] <... mmap resumed>) = 0x7f0c41dcd000 [pid 705] +++ exited with 0 +++ [pid 715] <... write resumed>) = 262144 [pid 709] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 709] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 709] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} => {parent_tid=[718]}, 88) = 718 [pid 709] rt_sigprocmask(SIG_SETMASK, [], [pid 715] munmap(0x7f0c41dee000, 138412032 [pid 709] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 715] <... munmap resumed>) = 0 [pid 709] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 709] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 715] openat(AT_FDCWD, "/dev/loop5", O_RDWR) = 4 [pid 715] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 718 attached [pid 714] <... ioctl resumed>) = 0 [pid 713] <... rt_sigprocmask resumed>[], 8) = 0 [pid 712] <... rt_sigprocmask resumed>[], 8) = 0 [pid 707] <... mount resumed>) = 0 [pid 718] set_robust_list(0x7f0c41ded9a0, 24 [pid 715] <... ioctl resumed>) = 0 [pid 714] close(3 [pid 713] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} [pid 712] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} [pid 707] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY [pid 714] <... close resumed>) = 0 [pid 714] mkdir("./file1", 0777 [pid 718] <... set_robust_list resumed>) = 0 [pid 715] close(3 [pid 707] <... openat resumed>) = 5 ./strace-static-x86_64: Process 719 attached ./strace-static-x86_64: Process 720 attached [pid 713] <... clone3 resumed> => {parent_tid=[719]}, 88) = 719 [pid 714] <... mkdir resumed>) = 0 [pid 712] <... clone3 resumed> => {parent_tid=[720]}, 88) = 720 [pid 707] chdir("./file1" [pid 718] rt_sigprocmask(SIG_SETMASK, [], [pid 715] <... close resumed>) = 0 [pid 714] mount("/dev/loop0", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 720] set_robust_list(0x7f0c41ded9a0, 24 [pid 719] set_robust_list(0x7f0c4a20e9a0, 24 [pid 718] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 715] mkdir("./file1", 0777 [pid 713] rt_sigprocmask(SIG_SETMASK, [], [pid 712] rt_sigprocmask(SIG_SETMASK, [], [pid 707] <... chdir resumed>) = 0 [pid 720] <... set_robust_list resumed>) = 0 [pid 719] <... set_robust_list resumed>) = 0 [pid 718] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 713] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 712] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 707] ioctl(6, LOOP_CLR_FD [pid 720] rt_sigprocmask(SIG_SETMASK, [], [pid 719] rt_sigprocmask(SIG_SETMASK, [], [pid 715] <... mkdir resumed>) = 0 [pid 713] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000 [pid 712] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 707] <... ioctl resumed>) = 0 [pid 720] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 719] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 718] <... open resumed>) = -1 EISDIR (Is a directory) [pid 715] mount("/dev/loop5", "./bus", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 713] <... futex resumed>) = 0 [pid 712] <... futex resumed>) = 0 [pid 707] close(6 [pid 720] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 719] memfd_create("syzkaller", 0 [pid 718] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 713] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 712] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 707] <... close resumed>) = 0 [pid 719] <... memfd_create resumed>) = 3 [pid 713] <... futex resumed>) = 0 [pid 709] <... futex resumed>) = 0 [pid 718] <... futex resumed>) = 1 [pid 707] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 720] <... open resumed>) = 3 [pid 720] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 719] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 718] mount("/dev/loop5", "./bus", NULL, MS_BIND, NULL [pid 713] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 709] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 707] <... futex resumed>) = 0 [pid 706] exit_group(0 [pid 720] <... futex resumed>) = 1 [pid 719] <... mmap resumed>) = 0x7f0c41dee000 [pid 718] <... mount resumed>) = -1 ENOTDIR (Not a directory) [pid 713] <... mmap resumed>) = 0x7f0c41dcd000 [pid 712] <... futex resumed>) = 0 [pid 709] <... futex resumed>) = 0 [pid 707] ????( [pid 713] mprotect(0x7f0c41dce000, 131072, PROT_READ|PROT_WRITE [pid 712] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 706] <... exit_group resumed>) = ? [pid 708] <... futex resumed>) = -1 (errno 18446744073709551414) [pid 707] <... ???? resumed>) = ? [pid 713] <... mprotect resumed>) = 0 [pid 712] <... futex resumed>) = 0 [pid 709] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 708] +++ exited with 0 +++ [pid 713] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 712] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 707] +++ exited with 0 +++ [pid 706] +++ exited with 0 +++ [pid 713] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c41ded990, parent_tid=0x7f0c41ded990, exit_signal=0, stack=0x7f0c41dcd000, stack_size=0x20300, tls=0x7f0c41ded6c0} => {parent_tid=[723]}, 88) = 723 [pid 713] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 713] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 713] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 720] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0 [pid 720] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 720] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 719] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144) = 262144 [pid 712] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 719] munmap(0x7f0c41dee000, 138412032 [pid 718] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 712] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 702] <... ioctl resumed>) = 0 [pid 298] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=706, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 719] <... munmap resumed>) = 0 [pid 719] openat(AT_FDCWD, "/dev/loop3", O_RDWR) = 4 [ 26.798804][ T707] ext4 filesystem being mounted at /root/syzkaller.qPQybd/13/file1 supports timestamps until 2038 (0x7fffffff) [ 26.809580][ T715] loop5: detected capacity change from 0 to 512 [ 26.833869][ T714] EXT4-fs (loop0): 1 orphan inode deleted [ 26.841116][ T714] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 26.842958][ T719] loop3: detected capacity change from 0 to 512 [pid 719] ioctl(4, LOOP_SET_FD, 3./strace-static-x86_64: Process 723 attached [pid 720] <... futex resumed>) = 0 [pid 718] <... futex resumed>) = 1 [pid 712] <... futex resumed>) = 1 [pid 709] <... futex resumed>) = 0 [pid 703] +++ exited with 0 +++ [pid 702] close(5 [pid 699] +++ exited with 0 +++ [pid 298] restart_syscall(<... resuming interrupted clone ...> [pid 719] <... ioctl resumed>) = 0 [pid 719] close(3) = 0 [pid 719] mkdir("./file1", 0777) = 0 [pid 719] mount("/dev/loop3", "./file1", "ext4", MS_NOSYMFOLLOW|MS_NOATIME|MS_REC, ",errors=continue" [pid 723] set_robust_list(0x7f0c41ded9a0, 24) = 0 [pid 723] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 723] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000) = 3 [pid 723] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 720] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 718] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 712] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 709] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 702] <... close resumed>) = 0 [pid 298] <... restart_syscall resumed>) = 0 [pid 723] <... futex resumed>) = 1 [pid 713] <... futex resumed>) = 0 [pid 723] mount("/dev/loop3", "./bus", NULL, MS_BIND, NULL [pid 713] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 723] <... mount resumed>) = 0 [pid 713] <... futex resumed>) = 0 [pid 723] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 713] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 723] <... futex resumed>) = 0 [pid 713] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 723] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c [pid 713] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 723] <... open resumed>) = 5 [pid 713] <... futex resumed>) = 0 [pid 723] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 713] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 723] <... futex resumed>) = 0 [pid 713] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 723] write(5, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 713] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 713] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 714] <... mount resumed>) = 0 [pid 714] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY) = -1 ENOTDIR (Not a directory) [pid 714] ioctl(4, LOOP_CLR_FD) = 0 [pid 714] close(4) = 0 [pid 714] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 714] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 720] <... open resumed>) = 4 [pid 720] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 720] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 718] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 718] open("./bus", O_RDWR|O_SYNC|O_NOATIME|0x3c) = -1 EISDIR (Is a directory) [pid 718] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 718] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 712] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 712] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 1 [pid 712] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 714] <... futex resumed>) = 0 [pid 714] write(4, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 709] <... futex resumed>) = 1 [pid 702] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 702] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 709] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 696] exit_group(0 [pid 709] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 709] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 704] <... futex resumed>) = ? [pid 696] <... exit_group resumed>) = ? [pid 709] <... futex resumed>) = 0 [pid 704] +++ exited with 0 +++ [pid 709] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 702] <... futex resumed>) = -1 (errno 18446744073709551414) [pid 723] <... write resumed>) = 8 [pid 296] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=699, si_uid=0, si_status=0, si_utime=0, si_stime=2} --- [pid 702] +++ exited with 0 +++ [pid 296] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 723] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 696] +++ exited with 0 +++ [pid 295] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=696, si_uid=0, si_status=0, si_utime=0, si_stime=1} --- [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 718] <... futex resumed>) = 0 [pid 296] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 298] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY [pid 718] write(-1, "\x31\x30\x30\x30\x30\x30\x30\x00", 8 [pid 298] <... openat resumed>) = 3 [pid 296] <... openat resumed>) = 3 [pid 723] <... futex resumed>) = 1 [pid 718] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 713] <... futex resumed>) = 0 [pid 298] newfstatat(3, "", [pid 296] newfstatat(3, "", [pid 713] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 718] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 723] write(5, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 713] <... futex resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 718] <... futex resumed>) = 1 [pid 709] <... futex resumed>) = 0 [pid 713] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 709] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 718] write(-1, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 709] <... futex resumed>) = 0 [pid 718] <... write resumed>) = -1 EBADF (Bad file descriptor) [pid 296] getdents64(3, [pid 709] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 718] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 298] getdents64(3, [pid 296] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 104 [pid 709] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 718] <... futex resumed>) = 0 [pid 298] <... getdents64 resumed>0x555556d8e730 /* 5 entries */, 32768) = 136 [pid 723] <... write resumed>) = 1045 [pid 718] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] umount2("./13", MNT_DETACH|UMOUNT_NOFOLLOW [pid 723] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 723] <... futex resumed>) = 1 [pid 713] <... futex resumed>) = 0 [pid 298] <... umount2 resumed>) = 0 [pid 296] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] openat(AT_FDCWD, "./13", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3 [pid 723] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 298] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] <... umount2 resumed>) = 0 [pid 295] newfstatat(3, "", [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 296] umount2("./13/bus", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_EMPTY_PATH) = 0 [pid 298] newfstatat(AT_FDCWD, "./13/bus", [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] getdents64(3, [pid 298] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./13/bus" [pid 296] newfstatat(AT_FDCWD, "./13/bus", [pid 295] <... getdents64 resumed>0x555556d8e730 /* 4 entries */, 32768) = 112 [pid 298] <... unlink resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 298] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./13/bus" [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 298] newfstatat(AT_FDCWD, "./13/binderfs", [pid 296] <... unlink resumed>) = 0 [pid 295] newfstatat(AT_FDCWD, "./13/binderfs", [pid 298] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] umount2("./13/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW [pid 295] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 298] unlink("./13/binderfs" [pid 296] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] unlink("./13/binderfs" [pid 298] <... unlink resumed>) = 0 [pid 298] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] newfstatat(AT_FDCWD, "./13/binderfs", [pid 295] <... unlink resumed>) = 0 [pid 296] <... newfstatat resumed>{st_mode=S_IFLNK|0777, st_size=13, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 295] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 296] unlink("./13/binderfs" [pid 295] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 295] newfstatat(AT_FDCWD, "./13/file1", [pid 296] <... unlink resumed>) = 0 [pid 295] <... newfstatat resumed>{st_mode=S_IFREG|000, st_size=0, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 296] getdents64(3, [pid 295] unlink("./13/file1") = 0 [pid 296] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 295] getdents64(3, [pid 296] close(3 [pid 295] <... getdents64 resumed>0x555556d8e730 /* 0 entries */, 32768) = 0 [pid 296] <... close resumed>) = 0 [pid 295] close(3 [pid 296] rmdir("./13" [pid 295] <... close resumed>) = 0 [pid 296] <... rmdir resumed>) = 0 [pid 296] mkdir("./14", 0777 [pid 295] rmdir("./13" [pid 296] <... mkdir resumed>) = 0 [pid 296] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 295] <... rmdir resumed>) = 0 [pid 296] <... openat resumed>) = 3 [pid 296] ioctl(3, LOOP_CLR_FD [pid 295] mkdir("./14", 0777 [pid 296] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 295] <... mkdir resumed>) = 0 [pid 714] <... write resumed>) = 8 [pid 296] close(3 [pid 295] openat(AT_FDCWD, "/dev/loop1", O_RDWR [pid 714] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 296] <... close resumed>) = 0 [pid 714] <... futex resumed>) = 1 [pid 712] <... futex resumed>) = 0 [pid 296] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 295] <... openat resumed>) = 3 [pid 714] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [ 26.852895][ T714] ext4 filesystem being mounted at /root/syzkaller.iF59aB/14/file1 supports timestamps until 2038 (0x7fffffff) [ 26.886906][ T719] EXT4-fs (loop3): can't read group descriptor 0 [ 26.887259][ T715] EXT4-fs (loop5): 1 orphan inode deleted [pid 712] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000./strace-static-x86_64: Process 726 attached [pid 719] <... mount resumed>) = -1 ENOMEM (Cannot allocate memory) [pid 714] <... futex resumed>) = -1 EAGAIN (Resource temporarily unavailable) [pid 712] <... futex resumed>) = 0 [pid 295] ioctl(3, LOOP_CLR_FD [pid 714] write(4, "\x23\x21\x20\x2e\x2f\x66\x69\x6c\x65\x31\x0a\x82\x6a\x3f\xc6\x7c\x3a\xab\x7d\x7e\x31\x38\xd5\xcc\x25\x19\xa6\xa8\xf7\xa0\x0b\xff\x3b\xee\x49\xbb\x93\x22\x1f\x4e\x80\x95\x34\x94\x23\x35\x8b\x24\xc3\x46\x99\x05\xf2\x81\x89\x7d\xc6\xe1\x7a\x55\x07\xba\x1b\x9e\x33\xcc\x8e\x4f\x28\xf6\xda\xe3\x4d\x29\x86\xca\x00\x9c\x79\xab\x46\x1e\x69\xfd\x74\xcc\xe8\xc9\xed\x5b\x91\x09\xf3\xfa\x42\xf4\x3d\x39\x82\xeb"..., 1045 [pid 712] futex(0x7f0c4a2da6cc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 296] <... clone resumed>, child_tidptr=0x555556d8d690) = 726 [pid 295] <... ioctl resumed>) = -1 ENXIO (No such device or address) [pid 714] <... write resumed>) = 1045 [pid 295] close(3 [pid 714] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 295] <... close resumed>) = 0 [pid 714] <... futex resumed>) = 1 [pid 712] <... futex resumed>) = 0 [pid 295] clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD [pid 714] futex(0x7f0c4a2da6c8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 712] exit_group(0 [pid 714] <... futex resumed>) = ? [pid 712] <... exit_group resumed>) = ? [pid 295] <... clone resumed>, child_tidptr=0x555556d8d690) = 727 [pid 714] +++ exited with 0 +++ [pid 719] ioctl(4, LOOP_CLR_FD) = 0 [pid 719] close(4) = 0 [pid 719] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 713] exit_group(0 [pid 723] <... futex resumed>) = ? [pid 713] <... exit_group resumed>) = ? [pid 723] +++ exited with 0 +++ [pid 719] <... futex resumed>) = ? [pid 726] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 726] chdir("./14") = 0 [pid 726] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 726] setpgid(0, 0) = 0 [pid 726] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 726] write(3, "1000", 4) = 4 [pid 726] close(3) = 0 [pid 726] symlink("/dev/binderfs", "./binderfs") = 0 [pid 726] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 726] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, NULL, 8) = 0 [pid 726] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0 [pid 726] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1ee000 [pid 726] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 726] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 726] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a20e990, parent_tid=0x7f0c4a20e990, exit_signal=0, stack=0x7f0c4a1ee000, stack_size=0x20300, tls=0x7f0c4a20e6c0} => {parent_tid=[728]}, 88) = 728 [pid 726] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 726] futex(0x7f0c4a2da6c8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 726] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 726] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0) = 0x7f0c4a1cd000 [pid 726] mprotect(0x7f0c4a1ce000, 131072, PROT_READ|PROT_WRITE) = 0 [pid 726] rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 [pid 726] clone3({flags=CLONE_VM|CLONE_FS|CLONE_FILES|CLONE_SIGHAND|CLONE_THREAD|CLONE_SYSVSEM|CLONE_SETTLS|CLONE_PARENT_SETTID|CLONE_CHILD_CLEARTID, child_tid=0x7f0c4a1ed990, parent_tid=0x7f0c4a1ed990, exit_signal=0, stack=0x7f0c4a1cd000, stack_size=0x20300, tls=0x7f0c4a1ed6c0} => {parent_tid=[729]}, 88) = 729 [pid 726] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 726] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000) = 0 [pid 726] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000}./strace-static-x86_64: Process 727 attached [pid 727] set_robust_list(0x555556d8d6a0, 24) = 0 [pid 727] chdir("./14") = 0 [pid 727] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0 [pid 727] setpgid(0, 0) = 0 [pid 727] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3 [pid 727] write(3, "1000", 4) = 4 [pid 727] close(3) = 0 [pid 727] symlink("/dev/binderfs", "./binderfs"./strace-static-x86_64: Process 729 attached ./strace-static-x86_64: Process 728 attached [pid 720] <... futex resumed>) = ? [pid 727] <... symlink resumed>) = 0 [pid 728] set_robust_list(0x7f0c4a20e9a0, 24 [pid 720] +++ exited with 0 +++ [pid 712] +++ exited with 0 +++ [pid 298] <... umount2 resumed>) = 0 [pid 729] set_robust_list(0x7f0c4a1ed9a0, 24 [pid 728] <... set_robust_list resumed>) = 0 [pid 729] <... set_robust_list resumed>) = 0 [pid 728] rt_sigprocmask(SIG_SETMASK, [], [pid 729] rt_sigprocmask(SIG_SETMASK, [], [pid 728] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 727] futex(0x7f0c4a2da6cc, FUTEX_WAKE_PRIVATE, 1000000 [pid 729] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 728] memfd_create("syzkaller", 0 [pid 729] open("./bus", O_RDWR|O_CREAT|O_NOCTTY|O_SYNC|O_NOFOLLOW|O_NOATIME|O_CLOEXEC, 000 [pid 728] <... memfd_create resumed>) = 3 [pid 727] <... futex resumed>) = 0 [pid 729] <... open resumed>) = 4 [pid 728] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0 [pid 729] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 728] <... mmap resumed>) = 0x7f0c41dcd000 [pid 727] rt_sigaction(SIGRT_1, {sa_handler=0x7f0c4a278060, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK|SA_RESTART|SA_SIGINFO, sa_restorer=0x7f0c4a269210}, [pid 729] <... futex resumed>) = 1 [pid 728] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 262144 [pid 729] futex(0x7f0c4a2da6d8, FUTEX_WAIT_PRIVATE, 0, NULL [pid 727] <... rt_sigaction resumed>NULL, 8) = 0 [pid 728] <... write resumed>) = 262144 [pid 727] rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], [pid 728] munmap(0x7f0c41dcd000, 138412032 [pid 727] <... rt_sigprocmask resumed>NULL, 8) = 0 [pid 728] <... munmap resumed>) = 0 [pid 727] mmap(NULL, 135168, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_STACK, -1, 0 [pid 728] openat(AT_FDCWD, "/dev/loop2", O_RDWR [pid 727] <... mmap resumed>) = 0x7f0c4a1ee000 [pid 728] <... openat resumed>) = 5 [pid 727] mprotect(0x7f0c4a1ef000, 131072, PROT_READ|PROT_WRITE [pid 728] ioctl(5, LOOP_SET_FD, 3 [pid 727] <... mprotect resumed>) = 0 [pid 726] <... futex resumed>) = 0 [pid 719] +++ exited with 0 +++ [pid 715] <... mount resumed>) = 0 [pid 713] +++ exited with 0 +++ [pid 298] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 294] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=712, si_uid=0, si_status=0, si_utime=0, si_stime=5} --- [pid 726] futex(0x7f0c4a2da6d8, FUTEX_WAKE_PRIVATE, 1000000 [pid 715] openat(AT_FDCWD, "./bus", O_RDONLY|O_DIRECTORY [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=713, si_uid=0, si_status=0, si_utime=0, si_stime=3} --- [pid 294] restart_syscall(<... resuming interrupted clone ...> [pid 729] <... futex resumed>) = 0 [pid 726] <... futex resumed>) = 1 [pid 715] <... openat resumed>) = 3 [pid 298] newfstatat(AT_FDCWD, "./13/file1", [pid 294] <... restart_syscall resumed>) = 0 [pid 729] mount("/dev/loop2", "./bus", NULL, MS_BIND, NULL [pid 726] futex(0x7f0c4a2da6dc, FUTEX_WAIT_PRIVATE, 0, {tv_sec=0, tv_nsec=50000000} [pid 715] chdir("./bus" [pid 298] <... newfstatat resumed>{st_mode=S_IFDIR|0700, st_size=4096, ...}, AT_SYMLINK_NOFOLLOW) = 0 [pid 729] <... mount resumed>) = 0 [pid 715] <... chdir resumed>) = 0 [pid 298] umount2("./13/file1", MNT_DETACH|UMOUNT_NOFOLLOW [pid 297] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 729] futex(0x7f0c4a2da6dc, FUTEX_WAKE_PRIVATE, 1000000 [pid 715] ioctl(4, LOOP_CLR_FD [pid 298] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 297] <... umount2 resumed>) = -1 EINVAL (Invalid argument) [pid 294] umount2("./14", MNT_DETACH|UMOUNT_NOFOLLOW [pid 729] <... futex resumed>) = 1 [pid 726] <... futex resumed>) = 0 [pid 715] <... ioctl resumed>) = 0 [pid 298] openat(AT_FDCWD, "./13/file1", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY